CVE-2026-111932Low· 3.4▾ SunlitCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
coder >= 2.34.0 < 2.34.2coder >= 2.33.0 < 2.33.8coder >= 2.30.0 < 2.32.7coder < 2.29.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVE-2026-111928Medium· 5.4Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
CVE-2026-111930Medium· 4.3Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
CVE-2026-111929Medium· 5.3Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
CVE-2026-111931Medium· 4.3Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy