Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available.
Problem types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Product status
>= 2.33.0, < 2.33.8
>= 2.30.0, < 2.32.7
< 2.29.17
References
github.com/.../coder/security/advisories/GHSA-7qw2-f75v-62f7
github.com/coder/coder/pull/25808
github.com/coder/coder/releases/tag/v2.29.17
github.com/coder/coder/releases/tag/v2.32.7
github.com/coder/coder/releases/tag/v2.33.8
github.com/coder/coder/releases/tag/v2.34.2