CVE-2014-10036: Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject...

Security readout for executives and security teams

This is a cross-site scripting issue in older JetBrains TeamCity versions before 8.1. A remote attacker could inject script or HTML through a feed URL parameter. For executives, risk centers on exposed CI systems, user sessions, and trust in build infrastructure, but the source bundle does not show active exploitation. Exposure is likely limited to organizations still running JetBrains TeamCity versions before 8.1. Risk increases if the TeamCity web interface is reachable by untrusted users or the internet. The bundle does not identify affected editions, platforms, or required authentication state. Treat this as a cleanup and exposure-reduction item unless legacy TeamCity is internet-facing. CI systems are sensitive infrastructure, so any pre-8.1 deployment should be upgraded or isolated promptly, even without confirmed active exploitation. Mitigation focus: Upgrade JetBrains TeamCity to version 8.1 or later.; Review JetBrains TeamCity 8.1 vendor guidance before remediation.; Restrict TeamCity access to trusted networks and users..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.