Vulnerabilities

TI-2023-11339 CVE-2023-26114 · GHSA-frjg-g767-7363

Origin validation error in code-server

MEDIUM 42

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0034 Published 2023-03-23 Fixed in 4.10.1 CWE-1385

TI-2021-18883 CVE-2021-42648 · GHSA-2gp3-6c9p-jp7w

LOW 29

Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00869 Published 2022-05-11 Fixed in 3.12.0 CWE-79

TI-2021-02741 CVE-2021-3810 · GHSA-49x3-8228-3w3m

LOW 35

code-server is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2021-09-17 Fixed in 3.12.0 CWE-1333