{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.34.0"
            },
            {
              "fixed": "2.34.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.33.0"
            },
            {
              "fixed": "2.33.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.30.0"
            },
            {
              "fixed": "2.32.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.29.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:34:26Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe `ApplicationName` and `LogoURL` appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails.\n\n\u003e **Note:** Exploitation requires the `Owner` role which already holds full administrative control of the deployment so practical impact is limited.\n\n### Impact\n\nAn Owner-role user could store HTML markup in the `ApplicationName` or `LogoURL` appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged `Owner` role.\n\n### Patches\n\nThe fix escapes the `ApplicationName` and `LogoURL` appearance values in HTML output before rendering.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nRestrict the `Owner` role to trusted administrators.\n\n### References\n\n- Fix: #25804\n\n### Credits\n\nWe\u0027d like to thank Anthropic\u0027s Security Team (ANT-2026-22453) for independently disclosing this issue!",
  "id": "GHSA-h58c-xccx-75m3",
  "modified": "2026-08-20T18:34:26Z",
  "published": "2026-08-20T18:34:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/pull/25804"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/coder/coder"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/releases/tag/v2.29.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/releases/tag/v2.32.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/releases/tag/v2.33.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/releases/tag/v2.34.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings"
}