JetBrains fixes TeamCity sandbox escape rated 8.8

JetBrains patched CVE-2026-106218, a sandbox escape in TeamCity's Kotlin DSL integration rated 8.8 on the CVSS v3 scale that allows arbitrary code execution on the TeamCity host. Releases before 2026.1.3 and 2025.11.7 are affected; the same batch fixed an SQL injection in the Exposed library before 1.5.1 and a Git submodule URL handling flaw in 2026.2.1. No exploitation in the wild or public proof-of-concept has been confirmed.

• CVE-2026-106218: TeamCity Kotlin DSL sandbox escape, CVSS 8.8
• Affected releases: TeamCity before 2026.1.3 and 2025.11.7
• Same batch fixed SQL injection in Exposed before 1.5.1 and a Git submodule URL flaw
• No confirmed exploitation in the wild or public PoC