Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because… (CVE-2026-111932)

The vulnerability in Coder involves stored HTML injection due to insufficient escaping of the ApplicationName and LogoURL settings. An attacker with Owner privileges can insert malicious HTML code into these settings, which then gets rendered in the dashboard interface and in email notifications to other users. This could lead to limited integrity impacts but does not affect confidentiality or availability. The affected versions are prior to 2.29.17, 2.32.7, 2.33.8, and 2.34.2 respectively for the specified version branches.

The vulnerability allows an attacker with Owner role to inject HTML content that is rendered in the user interface and email notifications. This can lead to limited integrity impact such as UI manipulation or phishing attempts within the context of the application. There is no direct confidentiality or availability impact reported. No known exploits are currently in the wild.

No explicit patch links or vendor advisory details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict Owner role assignments to trusted users only to mitigate risk of exploitation.