CVE-2026-111932: Coder before 2.34.2 Stored HTML Injection via Appearance Settings
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected content?
An attacker must already have the Coder Owner role to change the affected appearance settings. Stored HTML can then render for users viewing the Coder dashboard and for deployment users receiving SMTP notification emails.
Which settings should be reviewed for malicious content?
Review the ApplicationName and LogoURL appearance settings. These settings can contain stored HTML markup that is rendered without sufficient escaping in affected releases.
Which versions need to be updated?
Update to 2.29.17 or later in the 2.29 line, 2.32.7 or later in the 2.32 line, 2.33.8 or later in the 2.33 line, or 2.34.2 or later in the 2.34 line. The issue affects versions before 2.29.17, 2.30.0 through before 2.32.7, 2.33.0 through before 2.33.8, and 2.34.0 through before 2.34.2.
What can be done if an update cannot be applied immediately?
Limit the Owner role to trusted administrators and review the ApplicationName and LogoURL values for HTML markup. Remove unexpected markup from those settings to prevent it from rendering in dashboards and notification emails.