Vulnerability Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Coder | Coder | < 2.29.17 |
Related Weaknesses (CWE)
References
- https://github.com/coder/coder/pull/25808Issue TrackingPatch
- https://github.com/coder/coder/releases/tag/v2.29.17Release Notes
- https://github.com/coder/coder/releases/tag/v2.32.7Release Notes
- https://github.com/coder/coder/releases/tag/v2.33.8Release Notes
- https://github.com/coder/coder/releases/tag/v2.34.2Release Notes
- https://github.com/coder/coder/security/advisories/GHSA-7qw2-f75v-62f7PatchVendor Advisory
FAQ
What is CVE-2026-55437?
CVE-2026-55437 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-...
How severe is CVE-2026-55437?
CVE-2026-55437 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55437?
Check the references section above for vendor advisories and patch information. Affected products include: Coder Coder.