Coder's `config-ssh` command previously wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) directly into the user's SSH configuration file without sanitization. This allowed a malicious or compromised server to inject arbitrary SSH configuration directives, including those enabling arbitrary code execution (e.g., via `ProxyCommand`). Exploitation requires control over server-supplied values, such as through a compromised server or administrative access. The vulnerability is tracked as CVE-2026-55427 and has been patched in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. The fix enforces strict validation rejecting newlines and control characters in these settings.

An attacker with control over the server-supplied SSH configuration values can inject arbitrary SSH directives into the user's SSH config file. This can lead to arbitrary code execution on the developer's workstation with the user's privileges, affecting all SSH connections initiated by that user. The impact includes full compromise of the local user environment via SSH configuration injection.

Apply the official patches available in Coder versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later, which validate and sanitize server-supplied SSH configuration values to prevent injection. As a workaround, inspect the output of `coder config-ssh --dry-run` before applying changes to detect any malicious configuration directives. No other mitigations are specifically recommended.