Threats Tagged 'ghsa-v54h-cp2w-9x4g'
View all threats tagged with 'ghsa-v54h-cp2w-9x4g'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-v54h-cp2w-9x4g'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-v54h-cp2w-9x4g: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace appsCVE-2026-55431 0 The vulnerability in github.com/coder/coder/v2 involves the `coder open app` CLI command, which opens external workspace app URLs without validating the URL scheme or host. If the URL contains the placeholder `$SESSION_TOKEN`, the CLI replaces it with the user's real session token before opening the URL. This can lead to session token leakage to arbitrary hosts controlled by an attacker. Exploitation requires the user to run `coder open app` on a workspace with a malicious external app URL defined by an attacker-controlled workspace. The vulnerability allows full account impersonation for the token's lifetime. Fixes have been released that apply a URL scheme allowlist and restrict token substitution to trusted destinations. Join the discussion | GCVE Database | 07/06/2026, 21:07:40 UTC Added: 07/06/2026, 23:02:27 UTC |
Showing 1 to 1 of 1 result