Skip to content
Threat Feed
Subscribe

Product

Go/Github.com/Coder/Coder (<= 0.27.3)

1 brief RSS
high advisory

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

A command injection vulnerability (CVE-2026-44454) in the Coder platform's `dotfiles` module allows arbitrary code execution in a user's workspace, exploitable via a one-click attack using the `mode=auto` feature on the Create Workspace page that automatically provisions a workspace with a malicious `param.dotfiles_uri` without user consent, leading to immediate arbitrary code execution and potential data compromise or lateral movement.

coder/registry +3 command-injection rce web-application workspace cloud coder
1r 2t 2i