The Coder dotfiles registry module improperly interpolated the user-supplied dotfiles_uri value directly into shell commands without sanitization, enabling command injection via shell expansions such as $(...), command separators, or backticks. This allowed arbitrary code execution within the user's workspace. The Create Workspace page's mode=auto parameter combined with param.* URL parameters enabled an attacker to craft a URL that silently provisions a workspace with malicious dotfiles_uri, requiring only that an authenticated user click the link. The primary fix involved input validation rejecting special characters and removing unsafe shell evaluation in the dotfiles module. Additionally, a consent dialog was introduced in the Coder product to prevent automatic workspace creation without explicit user confirmation, mitigating the one-click attack vector.

Successful exploitation results in arbitrary code execution within the victim's workspace. Depending on workspace privileges, this can lead to exposure of Git credentials, secrets, and workspace files, and potentially allow lateral movement within the environment. The mode=auto parameter reduces exploitation complexity to a single click by an authenticated user, increasing the risk of attack.

Official patches are available. The dotfiles module was updated to validate input and remove unsafe shell command execution, eliminating the root cause of command injection. The Coder product added a consent dialog requiring explicit user confirmation before workspace creation, removing the mode=auto automatic creation vector. Users should upgrade to patched releases: v2.29.7 (ESR) or v2.30.2 (mainline) or later. Patch status is confirmed by vendor advisories and GitHub commits linked in the advisory.