- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 4 · 3 high
- Registry
- npm
Advisories 4
- CVE-2025-47269High 8.3
code-server session cookie can be extracted by having user visit specially crafted proxy URL
Affected: fixed in 4.99.4.
- CVE-2023-26114High 8.2
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.
Affected: fixed in 4.10.1.
- CVE-2021-42648Unrated
Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted…
Affected: fixed in 3.12.0.
- CVE-2021-3810High 7.5
Inefficient Regular Expression Complexity in cdr/code-server
Affected: fixed in 3.12.0.