CVE-2026-44454: Coder command injection via workspace auto-creation deep links

CVE-2026-44454 · Severity: high · CVSS 8.1 · Published 2026-07-07

Coder is a platform used by organizations to manage and deploy remote development environments. A security flaw allowed attackers to create malicious links that, if clicked by a user, would automatically create a development workspace using settings controlled by the attacker. This could lead to the execution of unauthorized scripts or the installation of malicious configuration files within the user's development environment.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-44454 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44454 being exploited in the wild.
How severe is CVE-2026-44454?
High severity, with a CVSS score of 8.1, published 7 July 2026.
Which products and versions are affected?
Coder < 2.29.7, >= 2.30.0, < 2.30.2, <= 0.27.3, >= 2.30.0 < 2.30.2, < 2.29.7; github.com/coder/coder (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.27.3; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.7, SEMVER:introduced=0,fixed=2.29.7,introduced=2.30.0,fixed=2.30.2.
Is there a fix for CVE-2026-44454?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.29.7, 2.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44454 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44454?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.29.7, 2.30.2 or later
    go get github.com/coder/coder/v2@v2.30.2

Technical details

A command injection vulnerability exists in Coder due to the improper handling of workspace parameters in 'mode=auto' deep links. Attackers can craft URLs with prefilled 'param.*' values (such as 'dotfiles_uri' or 'startup_script') that are silently processed without user interaction or confirmation. This allows for the execution of arbitrary code or OS commands within the context of the provisioned workspace. The issue is addressed in versions 2.29.7 and 2.30.2 by introducing a mandatory consent dialog that displays all prefilled parameters and requires explicit user confirmation before provisioning begins.

Affected products

  • Coder Coder < 2.29.7, >= 2.30.0, < 2.30.2

Identifiers

  • CVE-2026-44454
  • GHSA-m3cr-vc2j-pm27
  • GO-2026-5897

Timeline

  • 2026-02-12: patched: Initial fix commit merged into main branch
  • 2026-02-23: patched: Version 2.29.7 released
  • 2026-02-24: patched: Version 2.30.2 released
  • 2026-07-07: advisory: CVE-2026-44454 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.