GHSA-h58c-xccx-75m3: Low severity go/github.com/coder/coder/v2 vulnerability
Summary
The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails.
Note: Exploitation requires the Owner role which already holds full administrative control of the deployment so practical impact is limited.
Impact
An Owner-role user could store HTML markup in the ApplicationName or LogoURL appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged Owner role.
Patches
The fix escapes the ApplicationName and LogoURL appearance values in HTML output before rendering.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Restrict the Owner role to trusted administrators.
References
- Fix: #25804
Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22453) for independently disclosing this issue!
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.34.2 - Compensating control
Restrict the highly privileged Owner role to trusted administrators.
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
Exploitation requires a user with the Owner role. Because that role already has full administrative control of the deployment, the advisory describes the practical impact as limited.
Where would injected markup be rendered?
HTML stored in the ApplicationName or LogoURL appearance settings could be rendered in the Coder dashboard and in SMTP notification emails. This creates stored HTML injection against other deployment users.
Which release versions contain the fix?
The fix is available in v2.34.2 for the 2.34 line, v2.33.8 for 2.33, v2.32.7 for 2.32, and v2.29.17 for the 2.29 ESR line. The fix escapes ApplicationName and LogoURL values before HTML rendering.
How can administrators check for possible prior exploitation?
Review the configured ApplicationName and LogoURL appearance values for stored HTML markup. Any markup in these settings could have been rendered to dashboard users and recipients of SMTP notifications.