CVE-2026-55437
Fixed in a distro release EPSS <1%CVSS 5.4
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.
Products: coder
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/coder/coder | no fix |
| Go | github.com/coder/coder/v2 | 2.34.2 |
| Go | github.com/coder/coder/v2 | 2.33.8 |
| Go | github.com/coder/coder/v2 | 2.32.7 |
| Go | github.com/coder/coder/v2 | 2.29.17 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |