Developer-Tools - CraftedSignal Threat Feed

Coder SSH Config Injection Vulnerability (CVE-2026-55427)

hello@craftedsignal.io — Mon, 06 Jul 2026 20:55:41 +0000

The coder config-ssh utility from Coder is vulnerable to a critical configuration injection issue, tracked as CVE-2026-55427. This vulnerability allows a malicious or compromised Coder server to inject arbitrary SSH configuration directives, such as ProxyCommand, into a developer's ~/.ssh/config file. This occurs because coder config-ssh unsafely writes server-supplied values like HostnameSuffix and SSHConfigOptions without proper sanitization of newlines or restriction of directives. If a developer runs coder config-ssh while connected to such a server, it can lead to arbitrary code execution on their workstation with local user privileges. The vulnerability affects Coder versions prior to v2.34.2, v2.33.8, v2.32.7, and v2.29.17. The issue, independently disclosed by Anthropic's Security Team (ANT-2026-22437), highlights a potential supply chain risk through developer tooling.

Attack Chain

Initial Access / Server Compromise: An attacker gains control over a Coder server deployment or compromises its administrative interface, or a Coder server administrator acts maliciously.
Configuration Injection: The attacker modifies the Coder server's HostnameSuffix or SSHConfigOptions settings to include malicious SSH directives (e.g., ProxyCommand followed by a shell command) that exploit the lack of input sanitization.
Client-Side Configuration Request: A developer executes coder config-ssh on their workstation (typically Linux or macOS) to configure SSH access to Coder workspaces.
Malicious Configuration Download: The coder config-ssh utility fetches the unsanitized configuration values from the compromised Coder server.
Local SSH Config Modification: coder config-ssh writes the received malicious HostnameSuffix and SSHConfigOptions directly into the developer's ~/.ssh/config file, injecting the attacker-controlled SSH directives.
Triggering Execution: The developer subsequently initiates an SSH connection to any host that leverages the newly modified ~/.ssh/config.
Arbitrary Code Execution: The injected ProxyCommand (or similar directive) within ~/.ssh/config triggers the execution of the attacker's arbitrary code on the developer's workstation, operating with the privileges of the local user.

Impact

Successful exploitation of CVE-2026-55427 grants attackers arbitrary code execution capabilities on developer workstations. The injected commands run with the privileges of the local user, allowing for a wide range of malicious activities including data exfiltration, installation of malware, establishment of persistence, or further lateral movement within the developer's environment. Crucially, the malicious configuration applies to all SSH connections originating from the workstation, not just those related to Coder workspaces, broadening the scope of impact significantly. While no specific victim count is available, the vulnerability poses a substantial supply chain risk to organizations leveraging the Coder platform, as compromising a single Coder server could lead to compromise of numerous developer endpoints.

Recommendation

Patch CVE-2026-55427 on all affected Coder server deployments to versions v2.34.2, v2.33.8, v2.32.7, or v2.29.17 immediately.
Educate developers to review the output of coder config-ssh --dry-run before applying configuration changes to visually identify unexpected SSH directives.
Implement file integrity monitoring on ~/.ssh/config files on developer workstations to detect unauthorized or suspicious modifications (e.g., via file_event logging).

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:07:52 +0000

A critical vulnerability, tracked as CVE-2026-33646, affects Mise, a popular multi-tool version manager. This flaw allows for arbitrary code execution on user systems when processing .tool-versions files. Unlike .mise.toml files, .tool-versions are not subject to a trust verification mechanism in non-paranoid mode (which is the default). This means an attacker can embed malicious Tera template syntax, specifically using the exec() function, into a .tool-versions file within a Git repository. When a victim, with mise activated, changes directory (cd) into such a repository, the malicious commands execute silently and automatically, leveraging the full privileges and environment variables of the current user. The vulnerability affects Mise versions prior to 2026.3.10 and poses a significant supply chain risk to developers.

Attack Chain

An attacker crafts a malicious .tool-versions file containing Tera template syntax with an exec() function call (e.g., {{ exec(command="malicious_command") }}) and embeds it in a Git repository.
The victim, who has mise activated in their shell (e.g., eval "$(mise activate zsh)"), clones or downloads this malicious Git repository.
The victim navigates into the cloned repository's directory using a command like cd.
Mise's shell hook (hook-env) automatically triggers, initiating the parsing of configuration files, including the malicious .tool-versions file.
During parsing, the ToolVersions::parse_str function processes the .tool-versions file content through the Tera template engine without performing a trust check.
The Tera engine evaluates the embedded exec() function, which in turn spawns a shell process to execute the attacker-defined arbitrary command (e.g., curl for exfiltration or id for reconnaissance).
The malicious command executes silently as the victim's current user with their full environment, without any warning or user interaction.
This allows the attacker to achieve arbitrary code execution, potentially leading to data exfiltration, further compromise, or system modification, as demonstrated by the PoC's curl or id commands.

Impact

The successful exploitation of CVE-2026-33646 leads to arbitrary code execution on the victim's machine. This presents a critical supply chain attack vector, as .tool-versions files are commonly committed to repositories and are expected to be benign. Execution occurs silently without any user prompt or warning, running with the full privileges and environment of the current user. This allows attackers to perform actions such as credential theft by exfiltrating environment variables (which may contain tokens, API keys, or SSH agent information) or establishing further persistence. The widespread use of mise in development environments means a broad range of open-source projects and developer machines are potentially vulnerable.

Recommendation

Patch CVE-2026-33646 by updating mise to version 2026.3.10 or newer immediately.
Deploy the provided Sigma rule to detect suspicious curl commands used for data exfiltration, often indicative of arbitrary code execution.
Enable process_creation logging for shell processes (bash, zsh, powershell, cmd.exe) to capture commands executed in user environments, especially in newly cloned or untrusted repositories.
Review and implement the recommended trust checks for .tool-versions files if patching is not immediately feasible.