# Coder stored HTML injection in appearance settings

Source: https://junglewise.ai/threats/coder-stored-html-injection-in-appearance-settings-6383f259  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.4 · Published 2026-08-20

Coder, a development environment management platform, fails to properly escape user-supplied values in the ApplicationName and LogoURL appearance settings before rendering them into web dashboard HTML and SMTP notification emails. An Owner-role user could inject malicious HTML that affects other users viewing the dashboard or receiving emails. However, since exploitation requires the highly privileged Owner role which already has full administrative control, the practical security impact is limited.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.4, published 20 August 2026.

**Which products and versions are affected?** Coder 2.34.0-2.34.1, 2.33.0-2.33.7, 2.30.0-2.32.6, <2.29.17.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-02: Fix merged in PR #25804 (commit ec19bc4) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored HTML injection vulnerability (CWE-74) in Coder's appearance configuration system. The ApplicationName and LogoURL settings are rendered directly into HTML templates without proper escaping, allowing an Owner-role user to inject arbitrary HTML markup. The injected HTML is stored in the application settings and executed whenever the dashboard or SMTP notification emails are rendered to other users. The vulnerability requires the Owner role to exploit, which implies the attacker already has full administrative control over the Coder deployment. The fix escapes these values using an HTML encoding filter before rendering them in templates. Patches have been released for all supported release lines: v2.34.2, v2.33.8, v2.32.7, and v2.29.17 (ESR).

## Affected products

- Coder Coder 2.34.0-2.34.1, 2.33.0-2.33.7, 2.30.0-2.32.6, <2.29.17

## Timeline

- 2026-06-12: disclosed: Advisory initially published
- 2026-06-02: patched: Fix merged in PR #25804 (commit ec19bc4)
- 2026-08-20: advisory: Advisory updated and published to GitHub Advisory Database

## References

- [https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3](https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3)
- [https://github.com/coder/coder/pull/25804](https://github.com/coder/coder/pull/25804)
- [https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a](https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a)
- [https://github.com/coder/coder/releases/tag/v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17)
- [https://github.com/coder/coder/releases/tag/v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7)
- [https://github.com/coder/coder/releases/tag/v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)