CVE-2026-19284

Name of the Vulnerable Software and Affected Versions MauricioMilano coder-api versions prior to 1.1.1

Description Command injection is possible within the Projects Endpoint component. The issue resides in the createProject() function located in the src/core/projects.ts file. This flaw allows a local attacker to execute arbitrary commands on the system.

Recommendations As a temporary workaround, restrict access to the createProject() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.