Executive brief
Coder, a platform for managing remote development environments, is vulnerable to a security flaw in its dashboard. An attacker could inject malicious code into workspace logs that, when viewed by another user, could execute unauthorized actions in their browser. This could lead to the theft of session information or unauthorized access to the development platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Coder's 'AgentLogLine' dashboard component. The root cause is the improper instantiation of the 'ansi-to-html' library without the 'escapeXML: true' configuration, combined with the use of 'dangerouslySetInnerHTML' to render workspace agent log lines. Because server-side sanitization failed to neutralize HTML metacharacters, an attacker with the ability to control agent logs can embed malicious HTML/JavaScript. When a victim (such as an administrator or developer) views these logs in the Coder dashboard, the payload is executed in their browser session. The vulnerability is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by enforcing XML escaping before DOM insertion.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2
Timeline
- 2026-05-28: patched: Fix merged into main branch
- 2026-06-11: advisory: Security releases published for multiple versions
- 2026-07-08: disclosed: CVE published to NVD
References
- https://github.com/coder/coder/pull/25808
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-7qw2-f75v-62f7