5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55437

CVE-2026-55437: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables escapeXML: true so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55437

CVE-2026-55437:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.34.0, < 2.34.2	2.34.2
github.com/coder/coder/v2	go	>= 2.33.0, < 2.33.8	2.33.8
github.com/coder/coder/v2	go	>= 2.30.0, < 2.32.7	2.32.7
github.com/coder/coder/v2	go	< 2.29.17	2.29.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored HTML injection (Cross-Site Scripting) within the Coder platform's agent log viewer. The root cause is the improper use of the ansi-to-html library. The AgentLogLine component in the file site/src/modules/resources/AgentLogs/AgentLogLine.tsx was responsible for converting log lines containing ANSI escape codes into HTML for display. The patch in commit f06b9d55df2880389e7f684c0644584b79a1e413 clearly shows the fix: the AnsiToHTML converter is instantiated with the escapeXML: true option. Previously, this option was omitted, causing the library to not escape HTML metacharacters within the log text. Consequently, if an attacker could write log entries containing HTML, any user (including administrators) viewing those logs would have that HTML rendered in their browser. This could lead to session hijacking, UI redressing, or data exfiltration. The vulnerable function is the AgentLogLine React component, which would be the component rendering the malicious content during runtime.

Vulnerable functions

AgentLogLine

site/src/modules/resources/AgentLogs/AgentLogLine.tsx

The `AgentLogLine` component used the `ansi-to-html` library to convert ANSI escape codes to HTML. The vulnerability lies in the instantiation of the `AnsiToHTML` class without setting the `escapeXML` option to `true`. This allowed HTML tags within the log data to be rendered as actual HTML in the browser, leading to a stored Cross-Site Scripting (XSS) vulnerability. The `dangerouslySetInnerHTML` React property was likely used to render the output of the conversion, making the injection possible.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.