https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333922 EUVD-2026-333922 https://cve.radiocsirt.org/vuln/euvd-2026-333922 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55437 <p>Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.</p> <p>Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55437 https://cve.radiocsirt.org/vuln/ghsa-7qw2-f75v-62f7 <p><strong>Affected:</strong> Go: github.com/coder/coder/v2</p> <p>### Summary</p> <p>The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.</p> <p>&gt; **Note:** Exploitation requires a victim to view attacker-controlled agent logs in the dashboard.</p> <p>### Impact</p> <p>A user who could run a workspace could emit arbitrary HTML into agent logs; when another user, including an administrator, viewed the workspace page, it rendered in their session. Content Security Policy blocked inline scripts but an attacker could still inject a `meta refresh` redirect, `style` rules for UI redressing or CSS-based exfiltration or external `img` beacons. This required workspace-owner access and a victim viewing the page.</p> <p>### Patches</p> <p>The fix enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion.</p> <p>The fix was backported to all supported release lines:</p> <p>| Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |</p> <p>### Workarounds</p> <p>None.</p> <p>### Resources</p> <p>- Fix: #25808</p> <p>### Credits</p> <p>Coder would like to thank Anthropic&#39;s Security Team (ANT-2026-22…</p> <p><strong>Affected:</strong> Go: github.com/coder/coder/v2</p> <p>### Summary</p> <p>The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.</p> <p>&gt; **Note:** Exploitation requires a victim to view attacker-controlled agent logs in the dashboard.</p> <p>### Impact</p> <p>A user who could run a workspace could emit arbitrary HTML into agent logs; when another user, including an administrator, viewed the workspace page, it rendered in their session. Content Security Policy blocked inline scripts but an attacker could still inject a `meta refresh` redirect, `style` rules for UI redressing or CSS-based exfiltration or external `img` beacons. This required workspace-owner access and a victim viewing the page.</p> <p>### Patches</p> <p>The fix enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion.</p> <p>The fix was backported to all supported release lines:</p> <p>| Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |</p> <p>### Workarounds</p> <p>None.</p> <p>### Resources</p> <p>- Fix: #25808</p> <p>### Credits</p> <p>Coder would like to thank Anthropic&#39;s Security Team (ANT-2026-22…</p> https://cve.radiocsirt.org/vuln/ghsa-7qw2-f75v-62f7