CVE-2026-55437: Coder Coder XSS Vulnerability

CVE-2026-55437 Overview

Coder is a platform that provisions remote development environments via Terraform. CVE-2026-55437 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Coder dashboard. The AgentLogLine component instantiated the ansi-to-html library without escapeXML: true and injected the resulting string via React's dangerouslySetInnerHTML. Server-side sanitization did not neutralize HTML metacharacters embedded in workspace agent log lines. An attacker who controls agent log output can inject HTML that renders as live markup when a victim views the affected logs in the dashboard.

Critical Impact
Attacker-controlled workspace agent log content executes as HTML in the browser of any authenticated user who views the logs, enabling session-scoped script execution within the Coder dashboard.

Affected Products

Coder versions prior to 2.29.17
Coder versions 2.30.x through 2.32.x prior to 2.32.7, and 2.33.x prior to 2.33.8
Coder versions 2.34.x prior to 2.34.2

Discovery Timeline

2026-07-08 - CVE-2026-55437 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55437

Vulnerability Analysis

The flaw is a stored XSS in the Coder web dashboard. The AgentLogLine React component renders workspace agent logs after passing them through the ansi-to-html library, which converts ANSI color escape sequences into HTML span tags. Because the library was instantiated without the escapeXML: true option, HTML metacharacters in the input passed through unchanged. The component then wrote the output into the DOM using dangerouslySetInnerHTML, bypassing React's default text escaping. Coder's server-side log sanitization did not neutralize HTML metacharacters either, so both input paths preserved attacker-supplied markup.

Exploitation requires an attacker to place HTML into workspace agent log lines and a victim with dashboard access to view those logs. The injected markup executes in the victim's browser under the Coder dashboard origin.

Root Cause

The root cause is missing output encoding in a client-side render path. The ansi-to-html constructor default leaves HTML metacharacters intact. Combined with dangerouslySetInnerHTML, any <, >, or attribute characters supplied in log text became executable markup rather than displayed text.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An attacker who can write to workspace agent logs, for example by controlling a workspace or executing commands whose output reaches the log stream, embeds an HTML or <script>-bearing payload. When another authenticated user opens the workspace and views agent logs, the payload renders and executes in that user's session context.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-7qw2-f75v-62f7 and Pull Request #25808 for technical detail on the fix.

Detection Methods for CVE-2026-55437

Indicators of Compromise

Workspace agent log lines that contain HTML tags such as <script>, <img>, <iframe>, or event handler attributes like onerror= and onload=.
Unexpected outbound requests from dashboard user browsers to attacker-controlled hosts shortly after viewing a workspace's agent logs.
Dashboard session activity, such as API calls or token usage, originating from user contexts immediately after log page views.

Detection Strategies

Scan stored agent log content in the Coder database for HTML metacharacters and known XSS payload patterns, focusing on <, >, and on[a-z]+= sequences in log text fields.
Review browser Content Security Policy (CSP) violation reports emitted from the Coder dashboard origin for inline script or external resource violations.
Correlate workspace ownership with dashboard viewer identity to identify sessions where a low-privilege workspace owner's logs were viewed by higher-privilege operators.

Monitoring Recommendations

Alert on Coder dashboard sessions that issue unusual administrative API calls immediately after loading /workspaces/* log endpoints.
Log and retain workspace agent log ingestion for retrospective payload analysis after patching.
Monitor Coder release channels and apply update alerts for versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 or later.

How to Mitigate CVE-2026-55437

Immediate Actions Required

Upgrade Coder to version 2.29.17, 2.32.7, 2.33.8, or 2.34.2, matching the release branch currently deployed.
Restrict workspace creation and agent execution privileges to trusted users until the upgrade completes.
Rotate Coder session tokens and API keys for any user who viewed agent logs from untrusted workspaces prior to the patch.

Patch Information

Coder fixed the issue by enabling escapeXML: true when instantiating ansi-to-html, ensuring HTML metacharacters are escaped before the string is inserted via dangerouslySetInnerHTML. Fixed releases are v2.29.17, v2.32.7, v2.33.8, and v2.34.2. The corresponding source change is tracked in Pull Request #25808.

Workarounds

No workarounds are available per the vendor advisory; upgrading is the only supported mitigation.
As a compensating control until upgrade, limit dashboard access to logs from workspaces owned by untrusted users.

bash

# Verify the running Coder server version and upgrade to a fixed release
coder version

# Example upgrade paths per release branch (choose the one matching your deployment)
# 2.29.x branch
helm upgrade coder coder-v2/coder --version 2.29.17
# 2.32.x branch
helm upgrade coder coder-v2/coder --version 2.32.7
# 2.33.x branch
helm upgrade coder coder-v2/coder --version 2.33.8
# 2.34.x branch
helm upgrade coder coder-v2/coder --version 2.34.2