{"id":"CVE-2026-111932","kind":"vulnerability","aliases":["CVE-2026-111932"],"related":[],"title":"Coder: stored HTML injection in appearance settings hits dashboard and emails","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.","summary":"Coder's ApplicationName and LogoURL appearance settings are rendered into HTML without enough escaping. An attacker with the Owner role can store markup there that runs in the Coder dashboard and in SMTP notification emails sent to other users.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","infrastructure","kubernetes","self-hosted"],"not_affected_if":["patched-version","trusted-owners-only"],"how_to_check":"- Check the Coder server version with `coder version`; affected builds are below `2.29.17`, `2.30.0` to below `2.32.7`, `2.33.0` to below `2.33.8`, and `2.34.0` to below `2.34.2`.\n- Review who holds the Owner role and whether the ApplicationName or LogoURL settings were changed by someone untrusted.","fix":"- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2` depending on the release line in use.\n- Until upgraded, restrict the Owner role to trusted administrators and reset ApplicationName and LogoURL to known-good values.","status":"open","published_at":"2026-10-17T19:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:33:37+00:00","updated_at":"2026-10-25T04:33:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T04:33:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2` depending on the release line in use.\n- Until upgraded, restrict the Owner role to trusted administrators and reset ApplicationName and LogoURL to known-good values.","reach":"network","title":"Coder: stored HTML injection in appearance settings hits dashboard and emails","impact":"medium","summary":"Coder's ApplicationName and LogoURL appearance settings are rendered into HTML without enough escaping. An attacker with the Owner role can store markup there that runs in the Coder dashboard and in SMTP notification emails sent to other users.","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","kubernetes"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker-chosen HTML runs in dashboards and emails of other users","analyst_note":"","how_to_check":"- Check the Coder server version with `coder version`; affected builds are below `2.29.17`, `2.30.0` to below `2.32.7`, `2.33.0` to below `2.33.8`, and `2.34.0` to below `2.34.2`.\n- Review who holds the Owner role and whether the ApplicationName or LogoURL settings were changed by someone untrusted.","needs_analyst":false,"not_affected_if":["patched-version","trusted-owners-only"],"who_is_affected":"Deployments running a Coder version in the listed affected ranges are exposed. The risk is greatest where more than one person holds the Owner role or where users rely on Coder notification emails. Teams on a patched release or who only have trusted Owners have less exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3407,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111932':14A,17A '-2026':13A,16A '2.29.17':65C '2.30.0':66C '2.32.7':68C '2.33.0':69C '2.33.8':71C '2.34.0':73C '2.34.2':75C 'appear':6A,29B,87C 'applicationnam':26B,84C 'attack':39B,97C 'coder':1A,18B,24B,52B,63C,113C 'contain':76C 'cve':12A,15A 'dashboard':9A,53B,114C 'deploy':123C 'email':11A,58B,119C 'enough':36B 'escap':37B,96C 'hit':8A 'host':23B 'html':3A,34B,79C,92C,104C 'infrastructur':19B 'inject':4A,80C 'kubernet':20B 'logourl':28B,86C 'markup':46B,105C 'notif':57B,118C 'output':93C 'owner':42B,100C 'render':32B,90C,110C 'role':43B,101C 'run':49B 'self':22B 'self-host':21B 'sent':59B,120C 'set':7A,30B,88C,108C 'smtp':56B,117C 'store':2A,45B,78C,103C 'suffici':95C 'user':62B,124C 'vulner':81C 'without':35B,94C","nicknames":[],"mitigations":[],"who_affected":"Deployments running a Coder version in the listed affected ranges are exposed. The risk is greatest where more than one person holds the Owner role or where users rely on Coder notification emails. Teams on a patched release or who only have trusted Owners have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111932","severity":null,"published_at":"2026-10-17T19:16:36+00:00","modified_at":"2026-10-22T03:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}