GHSA-h58c-xccx-75m3 CVE-2026-111932 GO-2026-6267
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings
- Severity
- 4.8 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.17%
- Chance of exploitation in the next 30 days. Higher than 5.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
2.34.2- Upgrade github.com/coder/coder/v2 to this version or later
Description
Summary
The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails.
Note: Exploitation requires the
Ownerrole which already holds full administrative control of the deployment so practical impact is limited.
Impact
An Owner-role user could store HTML markup in the ApplicationName or LogoURL appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged Owner role.
Patches
The fix escapes the ApplicationName and LogoURL appearance values in HTML output before rendering.
The fix was backported to all supported release lines:
| Release line | Patched version |
|---|---|
| 2.34 | v2.34.2 |
| 2.33 | v2.33.8 |
| 2.32 | v2.32.7 |
| 2.29 (ESR) | v2.29.17 |
Workarounds
Restrict the Owner role to trusted administrators.
References
- Fix: #25804
Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22453) for independently disclosing this issue!
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/coder/coder | all versions |
No fix yet |
| github.com/coder/coder/v2 | >= 2.34.0, < 2.34.2 |
2.34.2 |
| github.com/coder/coder/v2 | >= 2.33.0, < 2.33.8 |
2.33.8 |
| github.com/coder/coder/v2 | >= 2.30.0, < 2.32.7 |
2.32.7 |
| github.com/coder/coder/v2 | < 2.29.17 |
2.29.17 |
| github.com/coder/coder/v2 | < 2.29.17>= 2.30.0, < 2.32.7>= 2.33.0, < 2.33.8>= 2.34.0, < 2.34.2 |
2.29.172.32.72.33.82.34.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/coder/coder/v2 Go → 2.34.2
- go
go get github.com/coder/coder/v2@v2.34.2 && go mod tidy
Severity breakdown
CVSS 4.0 4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- High
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 3.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Packages
Other links
- github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
- github.com/coder/coder/pull/25804
- github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a
- github.com/coder/coder/releases/tag/v2.29.17
- github.com/coder/coder/releases/tag/v2.32.7
- github.com/coder/coder/releases/tag/v2.33.8
- github.com/coder/coder/releases/tag/v2.34.2
- vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison | Medium | Also affects github.com/coder/coder |
| GHSA-qrwj-vh9x-gw5v Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write | High | Also affects github.com/coder/coder |
| GHSA-5wg6-jmq2-53pw Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing | Medium | Also affects github.com/coder/coder |
| GHSA-7qw2-f75v-62f7 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component | Medium | Also affects github.com/coder/coder |
| GHSA-84rm-42xw-mx52 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration | High | Also affects github.com/coder/coder |
| GHSA-wqxv-w64v-5wh6 Suspended Coder users retain access to AI Bridge LLM proxy endpoints | Medium | Also affects github.com/coder/coder |
| GHSA-f5vp-w269-392g Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints | Medium | Also affects github.com/coder/coder |
| GHSA-jqj2-x4c5-jfxm Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers | Medium | Also affects github.com/coder/coder |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor