← Back to CVE Explorer

CVE-2026-111932

Full vulnerability record from the local CVENow database.

Description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

Severity
MEDIUM
CVSS score
4.8 (v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
[email protected]
Published
2026-10-17 19:16:36.217000
Last modified
2026-10-22 03:16:32.203000
View original CVE JSON 
{
  "id": "CVE-2026-111932",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-17T19:16:36.217",
  "lastModified": "2026-10-22T03:16:32.203",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coder",
          "product": "coder",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/coder/coder/v2",
          "versions": [
            {
              "version": "2.34.0",
              "lessThan": "2.34.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.34.2",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "coder",
          "product": "coder",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/coder/coder/v2",
          "versions": [
            {
              "version": "2.33.0",
              "lessThan": "2.33.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.33.8",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "coder",
          "product": "coder",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/coder/coder/v2",
          "versions": [
            {
              "version": "2.30.0",
              "lessThan": "2.32.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.32.7",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "coder",
          "product": "coder",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/coder/coder/v2",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.29.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.29.17",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-22T02:08:37.846699Z",
          "id": "CVE-2026-111932",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings",
      "source": "[email protected]"
    }
  ]
}