{"id":"CVE-2026-111932","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-17T19:16:36.217","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users."},{"lang":"es","value":"Coder en versiones anteriores a la 2.29.17; las versiones 2.30.0 hasta las anteriores a la 2.32.7; las versiones 2.33.0 hasta las anteriores a la 2.33.8; y las versiones 2.34.0 hasta las anteriores a la 2.34.2 contiene una vulnerabilidad de inyección HTML almacenada porque las configuraciones de apariencia ApplicationName y LogoURL se renderizan en la salida HTML sin un escape suficiente. Atacantes con el rol de Propietario pueden almacenar marcado HTML en estas configuraciones que se renderiza en el panel de control de Coder y en los correos electrónicos de notificación SMTP enviados a otros usuarios del despliegue."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"coder","product":"coder","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","versions":[{"version":"2.34.0","lessThan":"2.34.2","versionType":"semver","status":"affected"},{"version":"2.34.2","versionType":"semver","status":"unaffected"}]},{"vendor":"coder","product":"coder","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","versions":[{"version":"2.33.0","lessThan":"2.33.8","versionType":"semver","status":"affected"},{"version":"2.33.8","versionType":"semver","status":"unaffected"}]},{"vendor":"coder","product":"coder","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","versions":[{"version":"2.30.0","lessThan":"2.32.7","versionType":"semver","status":"affected"},{"version":"2.32.7","versionType":"semver","status":"unaffected"}]},{"vendor":"coder","product":"coder","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","versions":[{"version":"0","lessThan":"2.29.17","versionType":"semver","status":"affected"},{"version":"2.29.17","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-22T02:08:37.846699Z","id":"CVE-2026-111932","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings","source":"disclosure@vulncheck.com"}]}