CVE-2023-26114

State: Published
Severity: 8.2 High
Published: Mar 23, 2023
Updated: Feb 25, 2025
Reserved: Feb 20, 2023

Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P	snyk
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-1385 Missing Origin Validation in WebSockets
CWE-346 Origin Validation Error

Affected Products

Product	Versions
code-servern/a	before 4.10.1Affected

References

https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7
https://github.com/coder/code-server/releases/tag/v4.10.1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.