CVE-2026-49371 is a reflected XSS vulnerability (CWE-79) identified in JetBrains TeamCity prior to version 2026.1.1. The issue arises in the keyword filter feature, where user-supplied input is not properly sanitized, enabling injection of malicious scripts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact but low integrity and no availability impact. The vulnerability is publicly disclosed but lacks an official remediation or patch at this time. TeamCity is not a cloud service, so remediation depends on user-applied updates.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser session when interacting with the keyword filter in TeamCity. This can lead to disclosure of sensitive information (high confidentiality impact). Integrity impact is low, and availability is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the JetBrains advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor JetBrains communications for updates and avoid using the vulnerable keyword filter feature if possible until a patch is released.