GHSA-7qw2-f75v-62f7

Source

https://github.com/advisories/GHSA-7qw2-f75v-62f7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7qw2-f75v-62f7/GHSA-7qw2-f75v-62f7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7qw2-f75v-62f7

Aliases

Published

2026-07-06T21:12:56Z

Modified

2026-07-07T20:41:24.766731317Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Details

Summary

The AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

Note: Exploitation requires a victim to view attacker-controlled agent logs in the dashboard.

Impact

A user who could run a workspace could emit arbitrary HTML into agent logs; when another user, including an administrator, viewed the workspace page, it rendered in their session. Content Security Policy blocked inline scripts but an attacker could still inject a meta refresh redirect, style rules for UI redressing or CSS-based exfiltration or external img beacons. This required workspace-owner access and a victim viewing the page.

Patches

The fix enables escapeXML: true so HTML metacharacters are escaped before DOM insertion.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

None.

Resources

Fix: #25808

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22449) for independently disclosing this issue!

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2026-07-06T21:12:56Z"
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7qw2-f75v-62f7/GHSA-7qw2-f75v-62f7.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7qw2-f75v-62f7/GHSA-7qw2-f75v-62f7.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7qw2-f75v-62f7/GHSA-7qw2-f75v-62f7.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7qw2-f75v-62f7/GHSA-7qw2-f75v-62f7.json"