CVE-2026-111932
Full vulnerability record from the local CVENow database.
Description
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-10-17 19:16:36.217000
Last modified
2026-11-04 23:10:00.223000
View original CVE JSON
{
"id": "CVE-2026-111932",
"sourceIdentifier": "[email protected]",
"published": "2026-10-17T19:16:36.217",
"lastModified": "2026-11-04T23:10:00.223",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users."
},
{
"lang": "es",
"value": "Coder en versiones anteriores a la 2.29.17; las versiones 2.30.0 hasta las anteriores a la 2.32.7; las versiones 2.33.0 hasta las anteriores a la 2.33.8; y las versiones 2.34.0 hasta las anteriores a la 2.34.2 contiene una vulnerabilidad de inyección HTML almacenada porque las configuraciones de apariencia ApplicationName y LogoURL se renderizan en la salida HTML sin un escape suficiente. Atacantes con el rol de Propietario pueden almacenar marcado HTML en estas configuraciones que se renderiza en el panel de control de Coder y en los correos electrónicos de notificación SMTP enviados a otros usuarios del despliegue."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.34.0",
"lessThan": "2.34.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.34.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.33.0",
"lessThan": "2.33.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.33.8",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.30.0",
"lessThan": "2.32.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.32.7",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "0",
"lessThan": "2.29.17",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.17",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
"baseScore": 3.4,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.7,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-22T02:08:37.846699Z",
"id": "CVE-2026-111932",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings",
"source": "[email protected]"
}
]
}