Executive brief
Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder
Affected products
- Go github.com/coder/coder/v2
- Go github.com/coder/coder
Junglewise Threat Intelligence
CVE-2025-58437: GO-2025-3938 - Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder
CVE-2025-58437 · Severity: low · CVSS 3.1 · Published 2025-09-17
Technologies: github.com/coder/coder/v2 (Go), github.com/coder/coder (Go). Vendors: Go.
Related threats
- Coder HTTP redirect injection in workspace agent API
- GO-2026-6267 - Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
- GO-2026-6265 - Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
- Coder CORS bypass in subdomain-based workspace app proxy
- Coder stored XSS in AgentLogLine dashboard component