{"id":"GO-2026-6267","revision":"986f75f130fe4ae9bb559c9e06786be3","records":[{"revision":"986f75f130fe4ae9bb559c9e06786be3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6267","aliases":["CVE-2026-111932","GHSA-h58c-xccx-75m3"],"title":"Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder","description":"Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-10-18T10:55:43.8155513+00:00","affected":[{"ecosystem":"Go","name":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.29.17"},{"kind":"introduced","version":"2.30.0"},{"kind":"fixed","version":"2.32.7"},{"kind":"introduced","version":"2.33.0"},{"kind":"fixed","version":"2.33.8"},{"kind":"introduced","version":"2.34.0"},{"kind":"fixed","version":"2.34.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3","https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a","https://github.com/coder/coder/pull/25804","https://github.com/coder/coder/releases/tag/v2.29.17","https://github.com/coder/coder/releases/tag/v2.32.7","https://github.com/coder/coder/releases/tag/v2.33.8","https://github.com/coder/coder/releases/tag/v2.34.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6267","license":"OSV · upstream source license applies","key":"osv:GO-2026-6267","identifiers":["GO-2026-6267","CVE-2026-111932","GHSA-h58c-xccx-75m3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}