CVE-2026-55437

Katalog CVE

CVSS 5.4 · Medium EPSS 0,32%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada coder. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

8 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coder/coder/security/advisories/GHSA-7qw2-f75v-62f7 patch · advisory vendor
• https://github.com/coder/coder/pull/25808 issue tracking · patch
• https://github.com/coder/coder/releases/tag/v2.29.17 release notes
• https://github.com/coder/coder/releases/tag/v2.32.7 release notes
• https://github.com/coder/coder/releases/tag/v2.33.8 release notes
• https://github.com/coder/coder/releases/tag/v2.34.2 release notes