CVE-2026-100254

EUVD-2026-89998
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://www.jetbrains.com/privacy-security/issues-fixed/