CVE-2026-106218: CWE-184 in JetBrains TeamCity

This vulnerability in JetBrains TeamCity allows an attacker with limited privileges to escape the Kotlin DSL sandbox environment, potentially leading to remote code execution on the server. The flaw is tracked as CWE-184 and affects versions prior to 2026.1.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided in the input data.

Successful exploitation could allow an attacker to execute arbitrary code on the TeamCity server, compromising confidentiality, integrity, and availability of the system. This could lead to full system compromise depending on the server environment and privileges of the TeamCity process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor JetBrains advisories for updates. Until a fix is available, consider restricting access to the TeamCity server and limiting privileges of users who can interact with the Kotlin DSL.