Threats tagged 'ghsa-c6h5-pw77-hjcp'

Coder versions 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contain a path traversal vulnerability in the AI Gateway passthrough router. This vulnerability allows authenticated users to send percent-encoded dot segments in paths to access unintended provider endpoints using the deployment's centrally managed provider key.