Live › vulnerability › CVE-2026-111932
Go to dashboardCoder's ApplicationName and LogoURL appearance settings are rendered into HTML without enough escaping. An attacker with the Owner role can store markup there that runs in the Coder dashboard and in SMTP notification emails sent to other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running a Coder version in the listed affected ranges are exposed. The risk is greatest where more than one person holds the Owner role or where users rely on Coder notification emails. Teams on a patched release or who only have trusted Owners have less exposure.
No product ranges from the sources yet.
coder version; affected builds are below 2.29.17, 2.30.0 to below 2.32.7, 2.33.0 to below 2.33.8, and 2.34.0 to below 2.34.2.2.29.17, 2.32.7, 2.33.8, or 2.34.2 depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111932")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.