Executive brief
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
Affected products
- Go github.com/coder/coder/v2
- Go github.com/coder/coder
Junglewise Threat Intelligence
GO-2026-6267 - Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
Severity: info · Published 2026-08-25
Vendors: Go.
Related threats
- Coder HTTP redirect injection in workspace agent API
- GO-2026-6265 - Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
- Coder CORS bypass in subdomain-based workspace app proxy
- Coder stored XSS in AgentLogLine dashboard component
- Coder improper certificate validation in AI Bridge Proxy