Stored HTML Injection Vulnerability in Coder Product
CVE-2026-111932

4.8MEDIUM

Key Information:

Vendor

Coder

Status
Coder
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111932?

The Coder product is vulnerable to stored HTML injection due to insufficient escaping of the ApplicationName and LogoURL settings. This allows users with Owner privileges to inject malicious HTML code into the settings, which then gets rendered within the Coder dashboard and SMTP email notifications sent to other users. This vulnerability can potentially lead to phishing attacks or unauthorized actions carried out through compromised notification emails, highlighting the importance of robust input validation and sanitization practices in web applications.

Affected Version(s)

coder 2.34.0 < 2.34.2

coder 2.33.0 < 2.33.8

coder 2.30.0 < 2.32.7

References

https://github.com/coder/coder/security/advisories/GHSA-h...
vendor-advisory
https://www.vulncheck.com/advisories/coder-before-2.34.2-...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.