Executive brief
Coder logs sensitive objects unsanitized in github.com/coder/coder
Affected products
- Go github.com/coder/coder/v2
- Go github.com/coder/coder
Junglewise Threat Intelligence
CVE-2025-66411: GO-2025-4182 - Coder logs sensitive objects unsanitized in github.com/coder/coder
CVE-2025-66411 · Severity: low · CVSS 3.1 · Published 2025-12-08
Technologies: github.com/coder/coder/v2 (Go), github.com/coder/coder (Go). Vendors: Go.
Related threats
- Coder HTTP redirect injection in workspace agent API
- GO-2026-6267 - Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
- GO-2026-6265 - Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
- Coder CORS bypass in subdomain-based workspace app proxy
- Coder stored XSS in AgentLogLine dashboard component