Executive brief
Coder is a platform used by organizations to manage and deploy remote development environments. A security flaw allowed attackers to create malicious links that, if clicked by a user, would automatically create a development workspace using settings controlled by the attacker. This could lead to the execution of unauthorized scripts or the installation of malicious configuration files within the user's development environment.
Technical details
A command injection vulnerability exists in Coder due to the improper handling of workspace parameters in 'mode=auto' deep links. Attackers can craft URLs with prefilled 'param.*' values (such as 'dotfiles_uri' or 'startup_script') that are silently processed without user interaction or confirmation. This allows for the execution of arbitrary code or OS commands within the context of the provisioned workspace. The issue is addressed in versions 2.29.7 and 2.30.2 by introducing a mandatory consent dialog that displays all prefilled parameters and requires explicit user confirmation before provisioning begins.
Affected products
- Coder Coder < 2.29.7, >= 2.30.0, < 2.30.2
Timeline
- 2026-02-12: patched: Initial fix commit merged into main branch
- 2026-02-23: patched: Version 2.29.7 released
- 2026-02-24: patched: Version 2.30.2 released
- 2026-07-07: advisory: CVE-2026-44454 published
References
- https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb
- https://github.com/coder/coder/pull/22011
- https://github.com/coder/coder/releases/tag/v2.29.7
- https://github.com/coder/coder/releases/tag/v2.30.2
- https://github.com/coder/coder/security/advisories/GHSA-m3cr-vc2j-pm27
- https://github.com/coder/registry/commit/8e68c96633f65a1babd76a93b6923e3deead4a82
- https://github.com/coder/registry/pull/703