# CVE-2026-55437: Coder stored XSS in AgentLogLine dashboard component

Source: https://junglewise.ai/threats/cve-2026-55437-coder-stored-xss-in-agentlogline-dashboard-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-55437 · Severity: medium · CVSS 5.4 · Published 2026-07-08

Coder, a platform for managing remote development environments, is vulnerable to a security flaw in its dashboard. An attacker could inject malicious code into workspace logs that, when viewed by another user, could execute unauthorized actions in their browser. This could lead to the theft of session information or unauthorized access to the development platform.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder), [github.com/coder/coder (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder), [github.com/coder/coder/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder-v2). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55437 being exploited in the wild.

**How severe is CVE-2026-55437?** Medium severity, with a CVSS score of 5.4, published 8 July 2026.

**Which products and versions are affected?** Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.

**Is there a fix for CVE-2026-55437?** Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55437 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55437?** Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later

  ```sh
  go get github.com/coder/coder/v2@v2.34.2
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Coder's 'AgentLogLine' dashboard component. The root cause is the improper instantiation of the 'ansi-to-html' library without the 'escapeXML: true' configuration, combined with the use of 'dangerouslySetInnerHTML' to render workspace agent log lines. Because server-side sanitization failed to neutralize HTML metacharacters, an attacker with the ability to control agent logs can embed malicious HTML/JavaScript. When a victim (such as an administrator or developer) views these logs in the Coder dashboard, the payload is executed in their browser session. The vulnerability is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by enforcing XML escaping before DOM insertion.

## Affected products

- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2

## Identifiers

- CVE-2026-55437
- GHSA-7qw2-f75v-62f7
- GO-2026-5919

## Timeline

- 2026-05-28: patched: Fix merged into main branch
- 2026-06-11: advisory: Security releases published for multiple versions
- 2026-07-08: disclosed: CVE published to NVD

## References

- [https://github.com/coder/coder/pull/25808](https://github.com/coder/coder/pull/25808)
- [https://github.com/coder/coder/releases/tag/v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17)
- [https://github.com/coder/coder/releases/tag/v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7)
- [https://github.com/coder/coder/releases/tag/v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8)
- [https://github.com/coder/coder/releases/tag/v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2)
- [https://github.com/coder/coder/security/advisories/GHSA-7qw2-f75v-62f7](https://github.com/coder/coder/security/advisories/GHSA-7qw2-f75v-62f7)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)