GHSA-h58c-xccx-75m3

Source

https://github.com/advisories/GHSA-h58c-xccx-75m3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h58c-xccx-75m3/GHSA-h58c-xccx-75m3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h58c-xccx-75m3

Aliases

GO-2026-6267

Published

2026-08-20T18:34:26Z

Modified

2026-08-26T01:20:31Z

Severity

3.4 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N CVSS Calculator

Summary

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Details

Summary

The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails.

Note: Exploitation requires the Owner role which already holds full administrative control of the deployment so practical impact is limited.

Impact

An Owner-role user could store HTML markup in the ApplicationName or LogoURL appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged Owner role.

Patches

The fix escapes the ApplicationName and LogoURL appearance values in HTML output before rendering.

The fix was backported to all supported release lines:

Release line	Patched version
2.34	v2.34.2
2.33	v2.33.8
2.32	v2.32.7
2.29 (ESR)	v2.29.17

Workarounds

Restrict the Owner role to trusted administrators.

References

Fix: #25804

Credits

We'd like to thank Anthropic's Security Team (ANT-2026-22453) for independently disclosing this issue!

Database specific

{
    "cwe_ids": [
        "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:34:26Z",
    "nvd_published_at": null,
    "severity": "LOW"
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h58c-xccx-75m3/GHSA-h58c-xccx-75m3.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h58c-xccx-75m3/GHSA-h58c-xccx-75m3.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h58c-xccx-75m3/GHSA-h58c-xccx-75m3.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h58c-xccx-75m3/GHSA-h58c-xccx-75m3.json"