GHSA-mcqq-fqgf-rxwm

Source

https://github.com/advisories/GHSA-mcqq-fqgf-rxwm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mcqq-fqgf-rxwm

Aliases

Published

2026-07-06T20:53:54Z

Modified

2026-07-07T16:11:08.644759952Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Details

Summary

coder config-ssh wrote server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration.

Note: Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the HostnameSuffix and SSHConfigOptions settings.

Impact

A server administrator or an attacker who controlled the server, could inject a directive such as ProxyCommand and achieve arbitrary code execution on any developer workstation that ran coder config-ssh. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces.

Patches

The fix validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

Inspect coder config-ssh --dry-run output before applying changes.

Resources

Fix: #26154

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!

Database specific

{
    "severity": "HIGH",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-74",
        "CWE-78"
    ],
    "github_reviewed_at": "2026-07-06T20:53:54Z"
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"