{"id":"GO-2025-3938","revision":"4d933a9781be45c6a8c91a528d22fd4f","records":[{"revision":"4d933a9781be45c6a8c91a528d22fd4f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3938","aliases":["CVE-2025-58437","GHSA-j6xf-jwrj-v5qp"],"title":"Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder","description":"Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder","state":0,"publishedAt":"2025-09-17T17:03:49+00:00","modifiedAt":"2026-03-03T04:57:27.422383+00:00","affected":[{"ecosystem":"Go","name":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.22.0"},{"kind":"fixed","version":"2.24.4"},{"kind":"introduced","version":"2.25.0"},{"kind":"fixed","version":"2.25.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp","https://nvd.nist.gov/vuln/detail/CVE-2025-58437","https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276","https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0","https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a","https://github.com/coder/coder/pull/19667","https://github.com/coder/coder/pull/19668","https://github.com/coder/coder/pull/19669"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3938","license":"OSV · upstream source license applies","key":"osv:GO-2025-3938","identifiers":["GO-2025-3938","CVE-2025-58437","GHSA-j6xf-jwrj-v5qp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}