CVE-2026-106218

JetBrains TeamCity before 2026.1.3 and before 2025.11.7 allows a Kotlin DSL sandbox escape that can lead to remote code execution on the TeamCity server. A network attacker who already has a low-privileged account can supply Kotlin DSL that is incompletely restricted (CWE-184), so code runs outside the sandbox with no further user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability of the server (CVSS 3.1 base score 8.8). Organizations running those unpatched TeamCity versions are affected, especially where project users can edit Kotlin DSL. The issue is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade JetBrains TeamCity to 2026.1.3 or 2025.11.7 (or a later release in those lines). Until then, limit which accounts can create or edit Kotlin DSL and do not expose the TeamCity server directly to the internet. If untrusted users could reach a vulnerable server, review recent project DSL changes and the server for signs of unexpected code execution.