CVE-2026-55437: Coder stored XSS in AgentLogLine dashboard component

CVE-2026-55437 · Severity: medium · CVSS 5.4 · Published 2026-07-08

Coder, a platform for managing remote development environments, is vulnerable to a security flaw in its dashboard. An attacker could inject malicious code into workspace logs that, when viewed by another user, could execute unauthorized actions in their browser. This could lead to the theft of session information or unauthorized access to the development platform.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-55437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55437 being exploited in the wild.
How severe is CVE-2026-55437?
Medium severity, with a CVSS score of 5.4, published 8 July 2026.
Which products and versions are affected?
Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.
Is there a fix for CVE-2026-55437?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55437 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55437?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later
    go get github.com/coder/coder/v2@v2.34.2

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Coder's 'AgentLogLine' dashboard component. The root cause is the improper instantiation of the 'ansi-to-html' library without the 'escapeXML: true' configuration, combined with the use of 'dangerouslySetInnerHTML' to render workspace agent log lines. Because server-side sanitization failed to neutralize HTML metacharacters, an attacker with the ability to control agent logs can embed malicious HTML/JavaScript. When a victim (such as an administrator or developer) views these logs in the Coder dashboard, the payload is executed in their browser session. The vulnerability is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by enforcing XML escaping before DOM insertion.

Affected products

  • Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2

Identifiers

  • CVE-2026-55437
  • GHSA-7qw2-f75v-62f7
  • GO-2026-5919

Timeline

  • 2026-05-28: patched: Fix merged into main branch
  • 2026-06-11: advisory: Security releases published for multiple versions
  • 2026-07-08: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.