How severe is CVE-2026-55437?

CVE-2026-55437 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-55437 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-55437?

CVE-2026-55437 affects Coder. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-55437?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-55437 published?

CVE-2026-55437 was published on 2026-07-08.

CVE-2026-55437

CVE-2026-55437 is a medium-severity vulnerability in Coder with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-79
Affected product: Coder
Published: 2026-07-08
Last modified: 2026-07-08

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.

Frequently asked questions

What is CVE-2026-55437?: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.
How severe is CVE-2026-55437?: CVE-2026-55437 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-55437 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-55437?: CVE-2026-55437 affects Coder. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-55437?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-55437 published?: CVE-2026-55437 was published on 2026-07-08.

References

Affected products (1)

cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*

More vulnerabilities in Coder

CVE-2026-46354 — Critical (CVSS 9.1): Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5,…
CVE-2026-55429 — High (CVSS 8.7): Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7,…
CVE-2026-55427 — High (CVSS 8.3): Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7,…
CVE-2026-55428 — High (CVSS 8.2): Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7,…
CVE-2024-27918 — High (CVSS 8.2): Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3,…
CVE-2026-44454 — High (CVSS 8.1): Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and…

All CVEs affecting Coder →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →