GHSA-h58c-xccx-75m3Published

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

osv · GHSA-h58c-xccx-75m3

Published

### Summary The `ApplicationName` and `LogoURL` appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. > **Note:** Exploitation requires the `Owner` role which already holds full administrative control of the deployment so practical impact is limited. ### Impact An Owner-role user could store HTML markup in the `ApplicationName` or `LogoURL` appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged `Owner` role. ### Patches The fix escapes the `ApplicationName` and `LogoURL` appearance values in HTML output before rendering. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict the `Owner` role to trusted administrators. ### References - Fix: #25804 ### Credits We'd like to thank Anthropic's Security Team (ANT-2026-22453) for independently disclosing this issue!

Source published: 20 Aug 2026 18:34:26 UTC
Source modified: 18 Oct 2026 10:55:43 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Publisher rating · LOW