{"id":"CVE-2026-100254","title":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings","summary":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"jetbrains","product":"teamcity","affected":["teamcity < 2025.11.8","teamcity >= 2026.1, < 2026.1.4"],"patched":["teamcity 2026.1.4"],"published":"2026-09-30","updated":"2026-10-06","sourceUpdated":"2026-10-06T16:42:11.860","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100254","references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","label":"cve@jetbrains.com"}],"tags":["nvd","cve.org"],"epss":0.00472,"epssPercentile":0.40629,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-30T15:36:44.398225Z"},"ingestedAt":"2026-09-30T16:10:07.700Z","slug":"CVE-2026-100254","body":"## Overview\n\nIn JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings\n\n## Affected\n\n- `teamcity < 2025.11.8`\n- `teamcity >= 2026.1, < 2026.1.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `teamcity 2026.1.4`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}