p PatchFirst

CVE-2026-111932

CVE-2026-111932 · Coder before 2.34.2 Stored HTML Injection via Appearance Settings

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

CVSS 4.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • coder

    Versions
    • ≥ 2.34.0, < 2.34.2: Affected (semver)
    • 2.34.2: Not affected (semver)

    Update to 2.34.2

  • coder

    Versions
    • ≥ 2.33.0, < 2.33.8: Affected (semver)
    • 2.33.8: Not affected (semver)

    Update to 2.33.8

  • coder

    Versions
    • ≥ 2.30.0, < 2.32.7: Affected (semver)
    • 2.32.7: Not affected (semver)

    Update to 2.32.7

  • coder

    Versions
    • ≥ 0, < 2.29.17: Affected (semver)
    • 2.29.17: Not affected (semver)

    Update to 2.29.17

Original sources

Check your server →