CVE-2026-55437

5.4 MEDIUM
Published: July 08, 2026 Modified: July 08, 2026
View on NVD

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/coder/coder/pull/25808
Source: security-advisories@github.com
https://github.com/coder/coder/releases/tag/v2.29.17
Source: security-advisories@github.com
https://github.com/coder/coder/releases/tag/v2.32.7
Source: security-advisories@github.com
https://github.com/coder/coder/releases/tag/v2.33.8
Source: security-advisories@github.com
https://github.com/coder/coder/releases/tag/v2.34.2
Source: security-advisories@github.com

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.4 / 10.0
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)