coder

Records43All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

coder records in CISA KEV

No coder vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Coder 23 records MEDIUM Code-server 3 records MEDIUM Agentapi 1 record MEDIUM Code-marketplace 1 record MEDIUM

Records

43 records

TI-2025-29799 CVE-2025-47269 · GHSA-p483-wpfp-42cj

code-server session cookie can be extracted by having user visit specially crafted proxy URL

HIGH 71

code-server runs VS Code on any machine anywhere through browser access.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.56284 Published 2025-05-09 Fixed in 4.99.4 CWE-441

TI-2025-37344 CVE-2025-59956 · GHSA-w64r-2g3w-w8w4

AgentAPI exposed user chat history via a DNS rebinding attack

MEDIUM 62

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00426 Published 2025-09-29 Fixed in 0.4.0 CWE-350

TI-2026-34071 CVE-2026-46354 · GHSA-6x44-w3xg-hqqf

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

MEDIUM 47

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00318 Published 2026-07-07 Fixed in 2.33.3, 2.32.2 +4 CWE-347

TI-2026-32394 CVE-2026-44454 · GHSA-m3cr-vc2j-pm27

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

MEDIUM 45

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02642 Published 2026-07-07 Fixed in 2.29.7, 2.30.2 CWE-78

TI-2026-27585 CVE-2026-35454 · GHSA-8x9r-hvwg-c55h

Code Extension Marketplace has a Zip Slip Path Traversal

MEDIUM 44

The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00349 Published 2026-04-06 Fixed in 2.4.2, 1.2.3-0.20260402184705-988440dee05f CWE-22

TI-2024-18523 CVE-2024-27918 · GHSA-7cc2-r658-7xpf

Coder's OIDC authentication allows email with partially matching domain to register

MEDIUM 44

Coder allows oragnizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00965 Published 2024-03-06 Fixed in 2.8.4, 2.7.3 +1 CWE-20

TI-2023-11339 CVE-2023-26114 · GHSA-frjg-g767-7363

Origin validation error in code-server

MEDIUM 42

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0034 Published 2023-03-23 Fixed in 4.10.1 CWE-1385

TI-2026-76132 CVE-2026-111927 · GHSA-47cv-h282-xh6p

Hostname prefix match in Coder workspace proxy leaks API keys

LOW 39

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, s…

CVSS 4.0HIGH 8.7 Network Low privileges User interaction EPSS 0.00205 Published 2026-10-17 Fixed in 2.35.4, 2.34.8 +2 CWE-522

TI-2026-45212 CVE-2026-63443

Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

LOW 39

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00762 Published 2026-09-15 Fixed in 2.29.19, 2.32.9 +2 CWE-863

TI-2026-39997 CVE-2026-55429 · GHSA-9rjw-3gwp-f59v

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00508 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-639

TI-2026-39996 CVE-2026-55428 · GHSA-wrq8-fcv5-8hvp

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00405 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-285

TI-2026-39995 CVE-2026-55427 · GHSA-mcqq-fqgf-rxwm

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00466 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-74

TI-2025-36196 CVE-2025-58437 · GHSA-j6xf-jwrj-v5qp

Coder's privilege escalation vulnerability could lead to a cross workspace compromise

LOW 37

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00412 Published 2025-09-06 Fixed in 2.24.4, 2.25.2 CWE-277

TI-2026-39999 CVE-2026-55431 · GHSA-v54h-cp2w-9x4g

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

LOW 36

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00336 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-522

TI-2026-82175 CVE-2026-118687 · GHSA-j9wc-wg7r-6rm3

Missing audience check in Coder GCP instance-identity login

LOW 35

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/goo…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00186 Published 2026-10-28 Fixed in 2.37.4, 2.36.7 +3 CWE-441

TI-2026-39782 CVE-2026-55077 · GHSA-29xf-69gq-m9jx

Coder: User-admin role can reset owner account password

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00615 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-285

TI-2026-39780 CVE-2026-55075 · GHSA-9r87-mvcw-x35f

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00479 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-287

TI-2026-33531 CVE-2026-45796 · GHSA-686c-7vgv-v3fx

Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0043 Published 2026-07-07 Fixed in 2.33.3, 2.32.2 +4 CWE-918

TI-2021-02741 CVE-2021-3810 · GHSA-49x3-8228-3w3m

Inefficient Regular Expression Complexity in cdr/code-server

LOW 35

code-server is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2021-09-17 Fixed in 3.12.0 CWE-1333

TI-2026-40004 CVE-2026-55436 · GHSA-84rm-42xw-mx52

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

LOW 34

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00258 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +1 CWE-295

TI-2025-40847 CVE-2025-66411 · GHSA-jf75-p25m-pw74

Coder logged sensitive objects unsanitized

LOW 34

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00249 Published 2025-12-03 Fixed in 2.28.4, 2.27.7 +1 CWE-532

TI-2026-39781 CVE-2026-55076 · GHSA-75vm-6w67-gwvp

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

LOW 33

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0061 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-287

TI-2026-40002 CVE-2026-55434 · GHSA-f5vp-w269-392g

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00552 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 CWE-770

TI-2026-39784 CVE-2026-55079 · GHSA-f962-qm93-mj4c

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00611 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-789

TI-2026-39783 CVE-2026-55078 · GHSA-2mg2-p7r7-g27f

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00602 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-409

Open these records in search →