PT-2026-69197
CVE-2026-19284
·
Published
2026-08-08
·
Updated
2026-10-23
Description by
CVSS 3.1
5.3
MediumMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
MauricioMilano coder-api versions prior to 1.1.1
Description
Command injection is possible within the Projects Endpoint component. The issue resides in the
createProject() function located in the src/core/projects.ts file. This flaw allows a local attacker to execute arbitrary commands on the system.Recommendations
As a temporary workaround, restrict access to the
createProject() function until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploitability
Exploit
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾