{"id":"CVE-2026-106218","published":"2026-10-06T17:17:24Z","modified":"2026-10-08T14:53:05Z","title":"In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"description":{"text":"In JetBrains TeamCity before 2026.1.3\n2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible","provenance":"source","from":"NVD"},"summary":{"text":"A sandbox escape in the Kotlin DSL of JetBrains TeamCity affects versions before 2026.1.3 and 2025.11.7, where a crafted Kotlin DSL script could break out of the sandbox. An attacker able to reach the TeamCity server over the network, with no authentication or user interaction required, could achieve remote code execution on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:21:00Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00319,"percentile":0.24884,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-93504","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93504","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106218","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.98,"detail":"percentile 0.2488"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}