Coder before 2.34.2 Stored HTML Injection via Appearance Settings

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111932 · Microsoft / collected KEV context

EUVD-2026-103299

GHSA-7cmx-x3cj-5mp3

GHSA-h58c-xccx-75m3

GO-2026-6267

cve-program · CVE-2026-111932

• https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
• https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings

euvd · EUVD-2026-103299

• https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
• https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings

nvd · CVE-2026-111932

• https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
• https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings

osv · GHSA-h58c-xccx-75m3

• https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
• https://github.com/coder/coder/pull/25804
• https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a
• https://github.com/coder/coder
• https://github.com/coder/coder/releases/tag/v2.29.17
• https://github.com/coder/coder/releases/tag/v2.32.7
• https://github.com/coder/coder/releases/tag/v2.33.8
• https://github.com/coder/coder/releases/tag/v2.34.2

osv · GO-2026-6267

• https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3
• https://github.com/coder/coder/commit/ec19bc41d80568c0eb9f74b526e8cc8ffbe3be9a
• https://github.com/coder/coder/pull/25804
• https://github.com/coder/coder/releases/tag/v2.29.17
• https://github.com/coder/coder/releases/tag/v2.32.7
• https://github.com/coder/coder/releases/tag/v2.33.8
• https://github.com/coder/coder/releases/tag/v2.34.2

No related operational record is retained in the current change model.