CVE-2026-111932
Received Received - Intake

Stored HTML Injection in Coder Dashboard via Owner-Controlled Settings

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111932
EUVD
EUVD-2026-103299

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
coder coder 2.34.0
coder coder 2.33.0
coder coder 2.30.0
coder coder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111932 is a stored HTML injection vulnerability in the Coder platform. It occurs because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can inject HTML markup into these settings, which then renders in the Coder dashboard and SMTP notification emails sent to other users.

Detection Guidance

Check Coder version with: coder version. If version is before 2.29.17, 2.30.0 to 2.32.6, 2.33.0 to 2.33.7, or 2.34.0 to 2.34.1, the system is vulnerable. Inspect ApplicationName and LogoURL settings in the Coder dashboard for any HTML markup.

Impact Analysis

The impact is limited since exploitation requires the Owner role, which already has full administrative control. However, injected HTML could potentially affect other users by rendering in the dashboard or emails. The severity is rated Low with a CVSS score of 3.4, as it requires high privileges and user interaction.

Compliance Impact

This vulnerability primarily involves stored HTML injection in the Coder platform's appearance settings, requiring Owner role privileges. While it could potentially expose sensitive data through rendered HTML in dashboards or emails, the practical impact is limited due to the high privilege requirement. No direct evidence suggests this vulnerability specifically violates GDPR or HIPAA compliance.

Mitigation Strategies

Upgrade Coder to version 2.34.2 or later. If upgrading is not immediately possible, restrict Owner role access to trusted users only. Review and remove any suspicious HTML markup from ApplicationName and LogoURL settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart