CVE-2026-44454

Name of the Vulnerable Software and Affected Versions coder versions prior to 2.29.7 coder versions prior to 2.30.2

Description A command injection issue exists in the dotfiles registry module where unsanitized user input is passed to shell commands. An attacker can provide a crafted dotfiles uri value containing shell command substitution, such as $(...), to execute arbitrary code within a provisioned workspace. This issue is amplified by a mode=auto query parameter on the Create Workspace page, which allows the automatic creation of a workspace without user confirmation when combined with param.* URL parameters. This enables a one-click attack where an authenticated user clicking a malicious link triggers the creation of a workspace with attacker-controlled parameters, potentially exposing Git credentials, secrets, and workspace files.

Recommendations Update coder to version 2.29.7 or later. Update coder to version 2.30.2 or later. Restrict the use of the dotfiles uri parameter to trusted values until the system is updated.