code-server (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package code-server, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2025-47269 — CVSS 8.3 (high): code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy…
• CVE-2023-26114 — CVSS 8.2 (high): Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this…
• CVE-2021-3810 — CVSS 7.5 (high): code-server is vulnerable to Inefficient Regular Expression Complexity
• CVE-2021-42648 — CVSS 6.1 (medium): Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted…