The AgentLogLine component in Coder's dashboard instantiated the ansi-to-html library without enabling escapeXML, causing HTML metacharacters in workspace agent logs to be rendered as live HTML via dangerouslySetInnerHTML. Server-side sanitization did not neutralize these characters, enabling stored HTML injection. Exploitation requires a workspace owner to inject malicious HTML into logs and a victim user to view those logs. While inline scripts are blocked by Content Security Policy, attackers can still leverage meta refresh redirects, CSS-based UI redressing, and data exfiltration techniques. The issue is fixed by enabling escapeXML: true in ansi-to-html, escaping HTML metacharacters before DOM insertion. Patches are available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 and later.

An attacker with workspace-owner privileges can inject arbitrary HTML into agent logs, which is then rendered in the browser of any user viewing the workspace page, including administrators. This can lead to UI redressing, forced page redirects via meta refresh, and CSS-based data exfiltration. Inline JavaScript execution is blocked by Content Security Policy, limiting the scope of exploitation. The vulnerability requires both the ability to write to logs and a victim viewing the logs, reducing the attack surface.

A fix is available and has been backported to all supported release lines: 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these versions or later to remediate the vulnerability. No workarounds are available. Applying the official patch ensures HTML metacharacters are properly escaped before rendering, preventing stored HTML injection.