CVE-2026-111932CWE-79cross-site-scripting

CVE-2026-111932

Low · published October 17, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00167 · 5.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-17T23:16Z
References (2)
https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3 · [email protected]https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings · [email protected]
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Coder before 2.34.2 Stored HTML Injection via Appearance Settings
    cvelistv5
  • 17 OCT 18:46Z
    Coder before 2.34.2 Stored HTML Injection via Appearance Settings
    cvelistv5