---
id: "CVE-2026-111932"
kind: "vulnerability"
aliases: ["CVE-2026-111932"]
title: "Coder: stored HTML injection in appearance settings hits dashboard and emails"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["coder", "infrastructure", "kubernetes", "self-hosted"]
not_affected_if: ["patched-version", "trusted-owners-only"]
published_at: "2026-10-17T19:16:36+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:33:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111932", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: stored HTML injection in appearance settings hits dashboard and emails

Coder's ApplicationName and LogoURL appearance settings are rendered into HTML without enough escaping. An attacker with the Owner role can store markup there that runs in the Coder dashboard and in SMTP notification emails sent to other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Coder server version with `coder version`; affected builds are below `2.29.17`, `2.30.0` to below `2.32.7`, `2.33.0` to below `2.33.8`, and `2.34.0` to below `2.34.2`.
- Review who holds the Owner role and whether the ApplicationName or LogoURL settings were changed by someone untrusted.

## Fix

- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2` depending on the release line in use.
- Until upgraded, restrict the Owner role to trusted administrators and reset ApplicationName and LogoURL to known-good values.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111932

## From the sources

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_