# code-server (npm) vulnerabilities

4 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/code-server

## Advisories (4)

### [CVE-2025-47269](https://cve.now/CVE-2025-47269): code-server session cookie can be extracted by having user visit specially crafted proxy URL

- Severity: High 8.3
- Published: May 9, 2025
- Affected: fixed in 4.99.4.

### [CVE-2023-26114](https://cve.now/CVE-2023-26114): Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.

- Severity: High 8.2
- Published: Mar 23, 2023
- Affected: fixed in 4.10.1.

### [CVE-2021-42648](https://cve.now/CVE-2021-42648): Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted…

- Severity: Unrated
- Published: May 11, 2022
- Affected: fixed in 3.12.0.

### [CVE-2021-3810](https://cve.now/CVE-2021-3810): Inefficient Regular Expression Complexity in cdr/code-server

- Severity: High 7.5
- Published: Sep 17, 2021
- Affected: fixed in 3.12.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/code-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.