Executive brief
Coder, a development environment management platform, fails to properly escape user-supplied values in the ApplicationName and LogoURL appearance settings before rendering them into web dashboard HTML and SMTP notification emails. An Owner-role user could inject malicious HTML that affects other users viewing the dashboard or receiving emails. However, since exploitation requires the highly privileged Owner role which already has full administrative control, the practical security impact is limited.
Technical details
This is a stored HTML injection vulnerability (CWE-74) in Coder's appearance configuration system. The ApplicationName and LogoURL settings are rendered directly into HTML templates without proper escaping, allowing an Owner-role user to inject arbitrary HTML markup. The injected HTML is stored in the application settings and executed whenever the dashboard or SMTP notification emails are rendered to other users. The vulnerability requires the Owner role to exploit, which implies the attacker already has full administrative control over the Coder deployment. The fix escapes these values using an HTML encoding filter before rendering them in templates. Patches have been released for all supported release lines: v2.34.2, v2.33.8, v2.32.7, and v2.29.17 (ESR).
Affected products
- Coder Coder 2.34.0-2.34.1, 2.33.0-2.33.7, 2.30.0-2.32.6, <2.29.17
Timeline
- 2026-06-12: disclosed: Advisory initially published
- 2026-06-02: patched: Fix merged in PR #25804 (commit ec19bc4)
- 2026-08-20: advisory: Advisory updated and published to GitHub Advisory Database
References
- https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
- https://github.com/coder/coder/pull/25804
- https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8