Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Summary

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.

Timeline

1. Jul 8, 2026, 12:29 AM UTCCVE published
2. Jul 8, 2026, 2:00 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 8, 2026, 2:00 PM UTCRecord last updated

Affected versions

• coder coder

  From 2.34.0 · fixed in 2.34.2; From 2.33.0 · fixed in 2.33.8; From 2.30.0 · fixed in 2.32.7; fixed in 2.29.17

• github.com/coder/coderGo

  All versions

• github.com/coder/coder/v2Go

  fixed in 2.29.17; From 2.30.0 · fixed in 2.32.7; From 2.33.0 · fixed in 2.33.8; From 2.34.0 · fixed in 2.34.2

• github.com/coder/coder/v2Go

  From 2.34.0 · fixed in 2.34.2

• github.com/coder/coder/v2Go

  From 2.33.0 · fixed in 2.33.8

• github.com/coder/coder/v2Go

  From 2.30.0 · fixed in 2.32.7

• github.com/coder/coder/v2Go

  fixed in 2.29.17

References 6