CVE-2026-111932
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
- CVSS 4.0
- 4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 3.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-25)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h58c-xccx-75m3 | Go | github.com/coder/coder/v2 | >=2.34.0 <2.34.2 | 2.34.2 |
| GHSA-h58c-xccx-75m3 | Go | github.com/coder/coder/v2 | >=2.33.0 <2.33.8 | 2.33.8 |
| GHSA-h58c-xccx-75m3 | Go | github.com/coder/coder/v2 | >=2.30.0 <2.32.7 | 2.32.7 |
| GHSA-h58c-xccx-75m3 | Go | github.com/coder/coder/v2 | <2.29.17 | 2.29.17 |
| GO-2026-6267 | Go | github.com/coder/coder | all versions | no fix published |
| GO-2026-6267 | Go | github.com/coder/coder/v2 | <2.29.17 >=2.30.0 <2.32.7 >=2.33.0 <2.33.8 >=2.34.0 <2.34.2 | 2.29.17, 2.32.7, 2.33.8, 2.34.2 |