github.com/coder/coder/v2 vulnerabilities

CVEs whose affected-version data names the github.com/coder/coder/v2 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

github.com/coder/coder/v2 vulnerabilities

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder: User-admin role can reset owner account password

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Coder's OIDC authentication allows email with partially matching domain to register