JetBrains has addressed six security vulnerabilities in its software development and project management products. The affected applications include IntelliJ IDEA, TeamCity, and YouTrack.
The most critical vulnerability, tracked as CVE-2026-59792, is an improper path handling (CWE-23) flaw that could allow attackers to exploit project workspace ID processing to perform path traversal and potentially execute code in affected IntelliJ IDEA environments.
Security researcher Antoni Tremblay reported this flaw, and it has been fixed in IntelliJ IDEA versions 2026.1.4 and 2026.2.
The vulnerability was reported by researcher @maple3142 and tracked as CVE-2026-59793, a CWE-73 flaw in TeamCity 2026.1.2’s Perforce VCS integration that could allow arbitrary file access through externally controlled file or path references.
Two stored cross-site scripting vulnerabilities in TeamCity, identified as CVE-2026-59794 and CVE-2026-59795, could allow malicious JavaScript to be stored and executed in users’ browsers.
The first issue involves agent-reported data displayed on the cloud profile page. At the same time, the second can be triggered through unauthenticated agent registration. JetBrains patched four high-severity issues in TeamCity version 2026.1.2.
JetBrains Patched Vulnerabilities
Successful exploitation of either vulnerability may lead to session theft, interface manipulation, or actions performed in the context of a logged-in TeamCity user.
Additionally, another TeamCity issue, CVE-2026-59796, may allow unauthorized pipeline modifications due to improper authorization checks.
Classified as CWE-862, this vulnerability, reported by researcher Alwion, could allow users to modify CI/CD pipeline configurations without the required permissions, posing risks to build integrity and software supply chain security.
JetBrains also resolved CVE-2026-59791 in YouTrack version 2026.2.17012. This low-severity issue permits CSS injection through Mermaid diagram rendering.
Affected Vulnerabilities
CVE-2026-59791 (Low): YouTrack CSS injection via Mermaid diagram rendering.
CVE-2026-59792 (Critical): IntelliJ IDEA path traversal that could enable code execution.
CVE-2026-59793 (High): TeamCity arbitrary file access through the Perforce VCS integration.
CVE-2026-59794 (High): TeamCity stored XSS through agent-reported data on the cloud profile page.
CVE-2026-59795 (High): TeamCity stored XSS through unauthenticated agent registration.
CVE-2026-59796 (High): TeamCity pipeline modification due to improper permission checks.
Reported by Rohit Prasanth (h3ri0s), this CSS injection vulnerability cannot directly execute scripts but can alter page presentation and potentially facilitate phishing or user interface deception attacks.
Organizations using the affected products should upgrade immediately to IntelliJ IDEA versions 2026.1.4 or 2026.2, TeamCity version 2026.1.2, and YouTrack version 2026.2.17012.
Administrators are also advised to review TeamCity agent registration settings, audit recent pipeline changes, and examine access logs for any unusual repository or file-access activity.
