CVE-2026-19284 Overview
CVE-2026-19284 is a command injection vulnerability in MauricioMilano coder-api through version 1.1.0. The flaw resides in the createProject function within src/core/projects.ts, part of the Projects Endpoint component. Unsanitized input reaches a shell-level operation, allowing an authenticated local attacker to inject arbitrary operating system commands. The maintainer received an issue report but has not published a fix. This weakness is categorized under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Critical Impact
A local attacker with low privileges can inject arbitrary commands through the createProject endpoint, gaining execution in the context of the coder-api service.
Affected Products
- MauricioMilano coder-api versions up to and including 1.1.0
- The vulnerable component is the Projects Endpoint (src/core/projects.ts)
- The vulnerable function is createProject
Discovery Timeline
- 2026-08-08 - CVE-2026-19284 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19284
Vulnerability Analysis
The vulnerability is a command injection flaw (CWE-74) in the createProject function of src/core/projects.ts. The function accepts client-supplied project metadata and passes it to a downstream shell operation without adequate neutralization of shell metacharacters. An authenticated local user invoking the Projects Endpoint can embed characters such as ;, &&, |, or backticks in project input fields. These characters break out of the intended argument context and execute additional commands under the identity of the coder-api process. Because the attack path requires local access with low privileges and no user interaction, exploitation is confined to users who already reach the API surface. Public references include the GitHub issue tracking the report and the VulDB entry for CVE-2026-19284.
Root Cause
The root cause is missing input neutralization on parameters consumed by createProject. The handler forwards attacker-controlled strings into a command-execution routine instead of using safe argument arrays or a strict allow-list. Any shell metacharacter in the payload is interpreted by the shell.
Attack Vector
Exploitation requires local access to the API and low-privilege authentication. The attacker submits a crafted request to the Projects Endpoint containing shell metacharacters in a field consumed by createProject. The injected commands execute in the process context of coder-api. See the project repository for endpoint definitions.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose only; refer to the linked advisories for parameter details.
Detection Methods for CVE-2026-19284
Indicators of Compromise
- Unexpected child processes spawned by the node process running coder-api, such as /bin/sh, bash, curl, or wget.
- Project records created with names or fields containing shell metacharacters (;, |, &, backticks, $().
- Outbound network connections from the coder-api host to unfamiliar destinations shortly after project-creation API calls.
Detection Strategies
- Enable process-lineage logging on hosts running coder-api and alert on shell interpreters spawned as children of the Node.js runtime.
- Log all HTTP requests to the Projects Endpoint and inspect request bodies for shell metacharacters in project fields.
- Correlate project-creation events with subsequent file writes or command execution on the host.
Monitoring Recommendations
- Forward coder-api application logs and host process telemetry to a centralized log platform for retention and query.
- Baseline the expected child processes of the coder-api service and alert on deviations.
- Monitor egress traffic from the API host to detect reverse shells or data staging following exploitation.
How to Mitigate CVE-2026-19284
Immediate Actions Required
- Restrict local and network access to the coder-api service to trusted operators only until a patch is released.
- Run coder-api as a dedicated low-privilege user with no shell and no write access outside its working directory.
- Audit existing project records for entries containing shell metacharacters and investigate the associated accounts.
Patch Information
No official patch is available. The maintainer was informed through an issue report but has not responded. Track the project repository and the VulDB entry for updates.
Workarounds
- Deploy the service inside a container or sandbox with no-new-privileges, a read-only root filesystem, and a minimal base image lacking shells and network utilities.
- Place a reverse proxy in front of the API that rejects requests containing shell metacharacters in project-related fields.
- If self-maintaining a fork, replace shell-based command execution in createProject with child_process.execFile using an argument array, and validate inputs against a strict allow-list.
# Example systemd hardening for the coder-api service
[Service]
User=coderapi
Group=coderapi
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
RestrictSUIDSGID=true
CapabilityBoundingSet=
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
