CVE-2026-111932

Coder before 2.34.2 Stored HTML Injection via Appearance Settings

State: Published
Severity: 4.8 Medium
Published: Oct 17, 2026
Updated: Oct 22, 2026
Reserved: Oct 17, 2026

Description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N	VulnCheck
3.1	3.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
codercoder	2.34.0 to before 2.34.2Affected 2.34.2Not affected
codercoder	2.33.0 to before 2.33.8Affected 2.33.8Not affected
codercoder	2.30.0 to before 2.32.7Affected 2.32.7Not affected
codercoder	before 2.29.17Affected 2.29.17Not affected

References

GitHub Security Advisory (GHSA-h58c-xccx-75m3)vendor-advisory
VulnCheck Advisory: Coder before 2.34.2 Stored HTML Injection via Appearance Settingsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.