CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Medium 4.8 Published 17 Oct 2026 Updated 22 Oct 2026

Attackers with Owner role can inject HTML into appearance settings, leading to XSS in dashboards and emails, potentially compromising user accounts.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-111932?

CVE-2026-111932 is a medium-severity cross-site scripting vulnerability in coder, published on 17 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

Weakness: CWE-79

Which versions are affected by CVE-2026-111932?

10 open source packages ship an affected version, including github.com/coder/coder/v2 and github.com/coder/coder.

Package	Affected	Fixed in
`github.com/coder/coder/v2` Go	All versions	`2.29.17, 2.32.7, 2.33.8, 2.34.2`
`github.com/coder/coder/v2` Go	All versions	`2.29.17`
`github.com/coder/coder/v2` Go	All versions	`2.29.17`
`github.com/coder/coder/v2` Go	From `2.30.0`	`2.32.7`
`github.com/coder/coder/v2` Go	From `2.30.0`	`2.32.7`
`github.com/coder/coder/v2` Go	From `2.33.0`	`2.33.8`

4 more packages

`github.com/coder/coder/v2` Go	From `2.33.0`	`2.33.8`
`github.com/coder/coder/v2` Go	From `2.34.0`	`2.34.2`
`github.com/coder/coder/v2` Go	From `2.34.0`	`2.34.2`
`github.com/coder/coder` Go	All versions	None

How do I fix CVE-2026-111932?

Upgrade github.com/coder/coder/v2 to a fixed version for your release line: 2.29.17, 2.32.7, 2.33.8 or 2.34.2.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-111932 being exploited?

There is no known exploitation of CVE-2026-111932 in the wild and no public exploit code.

Sources

Also known as GHSA-7cmx-x3cj-5mp3, GHSA-h58c-xccx-75m3, GO-2026-6267.