{"id":"CVE-2026-44454","summary":"Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent","details":"Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation. In versions 2.29.7 and 2.30.2, input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminated the command injection at its source.","aliases":["GHSA-m3cr-vc2j-pm27","GO-2026-5897"],"modified":"2026-08-12T03:51:13.598463154Z","published":"2026-07-07T20:16:39.161Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44454.json"},"references":[{"type":"WEB","url":"https://github.com/coder/coder/releases/tag/v2.29.7"},{"type":"WEB","url":"https://github.com/coder/coder/releases/tag/v2.30.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44454.json"},{"type":"ADVISORY","url":"https://github.com/coder/coder/security/advisories/GHSA-m3cr-vc2j-pm27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44454"},{"type":"FIX","url":"https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb"},{"type":"FIX","url":"https://github.com/coder/coder/pull/22011"},{"type":"FIX","url":"https://github.com/coder/registry/commit/8e68c96633f65a1babd76a93b6923e3deead4a82"},{"type":"FIX","url":"https://github.com/coder/registry/pull/703"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coder/coder","events":[{"introduced":"0"},{"fixed":"8a097ee635e091bc23309bc6e750aec945732a93"},{"introduced":"43e67d12e278e13399cffc77f132e8e628339477"},{"fixed":"fa050ee0abc24ddf1bf91fb26148a9c3b2bd1481"},{"fixed":"60e3ab7632f42415d283b9fd5622ee53a4639ceb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.29.7"},{"introduced":"2.30.0"},{"fixed":"2.30.2"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*"}},{"type":"GIT","repo":"https://github.com/coder/registry","events":[{"introduced":"0"},{"fixed":"8e68c96633f65a1babd76a93b6923e3deead4a82"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.29.6","v2.30.1","v2.30.0","v2.29.5","v2.29.4","v2.29.3","v2.29.2","v2.29.1","v2.29.0","v2.10.0","v2.9.0","v2.6.0","v2.8.0","v2.7.1","v2.7.0","v2.5.1","v2.5.0","v2.4.0","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.1","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.0.2","v0.27.1","v0.27.0","v0.26.2","v0.26.1","v0.26.0","v0.25.0","v0.24.1","v0.24.0","v0.23.7","v0.23.6","v0.23.5","v0.23.4","v0.23.3","v0.23.2","v0.23.1","v0.23.0","v0.22.2","v0.22.1","v0.22.0","v0.21.3","v0.21.2","v0.21.1","v0.21.0","v0.20.1","v0.20.0","v0.19.2","v0.19.1","v0.19.0","v0.18.1","v0.18.0","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.0","v0.15.3","v0.15.2","v0.15.1","v0.15.0","v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.9","v0.12.8","v0.12.7","v0.12.6","v0.12.5","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.2","v0.10.1","v0.10.0","rm","v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.15","v0.8.14","v0.8.13","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","release/coder/claude-code/v4.7.5","release/coder/git-config/v1.0.33","release/coder/jupyterlab/v1.2.2","release/coder/claude-code/v4.7.4","release/coder/claude-code/v4.7.3","release/coder/claude-code/v4.7.2","release/coder-labs/codex/v4.1.0","release/coder/agentapi/v2.1.0","release/coder/claude-code/v4.7.1","release/coder/mux/v1.0.8","release/coder/claude-code/v4.7.0","release/coder/claude-code/v4.6.0","release/coder/claude-code/v4.5.0","release/coder/claude-code/v4.4.2","release/coder/jetbrains-fleet/v1.0.3","release/coder/claude-code/v4.4.1","release/coder/claude-code/v4.4.0","release/coder-labs/codex/v4.0.0","release/coder/claude-code/v4.3.0","release/coder/mux/v1.0.7","release/coder/claude-code/v4.2.9","release/coder/jetbrains/v1.3.0","release/anomaly/tmux/v1.0.4","release/coder/vault-cli/v1.1.1","release/coder/mux/v1.0.6","release/coder/filebrowser/v1.1.4","release/coder/claude-code/v4.2.8","release/coder/zed/v1.1.3","release/coder/zed/v1.1.4","release/coder/code-server/v1.4.2","release/coder-labs/auggie/v0.3.0","release/coder-labs/sourcegraph-amp/v3.0.0","release/coder-labs/gemini/v3.0.0","release/coder-labs/copilot/v0.3.0","release/coder-labs/cursor-cli/v0.3.0","release/coder-labs/perplexica/v1.0.0","release/coder/claude-code/v4.2.7","release/coder/kasmvnc/v1.2.7","release/coder/git-clone/v1.2.3","release/harleylrn/kiro-cli/v1.0.1","release/harleylrn/kiro-cli/v1.0.0","release/coder/mux/v1.0.5","release/coder/claude-code/v4.2.6","release/coder/claude-code/v4.2.4","release/coder-labs/open-webui/v1.0.0","release/coder/vault-cli/v1.1.0","release/coder-labs/sourcegraph-amp/v2.1.0","release/coder/antigravity/v1.0.0","release/coder/jfrog-oauth/v1.2.4","release/coder/mux/v1.0.4","release/coder/mux/v1.0.3","release/coder/windsurf/v1.3.0","release/coder/vscode-desktop/v1.2.0","release/coder/vscode-desktop-core/v1.0.1","release/coder/kiro/v1.2.0","release/coder/cursor/v1.4.0","release/thezoker/nodejs/v1.0.13","release/mavrickrishi/auto-start-dev-server/v1.0.2","release/coder/vscode-web/v1.4.3","release/coder/vault-jwt/v1.2.2","release/coder/vault-github/v1.1.2","release/coder/slackme/v1.0.33","release/coder/git-clone/v1.2.2","release/coder/dotfiles/v1.2.3","release/coder/devcontainers-cli/v1.0.34","release/coder-labs/archive/v0.0.3","release/anomaly/tmux/v1.0.3","release/thezoker/nodejs/v1.0.12","release/mavrickrishi/nexus-repository/v1.0.2","release/djarbz/copyparty/v1.0.2","release/coder/zed/v1.1.2","release/coder/windsurf/v1.2.1","release/coder/vscode-web/v1.4.2","release/coder/vscode-desktop/v1.1.2","release/coder/vault-token/v1.3.1","release/coder/vault-jwt/v1.2.1","release/coder/vault-github/v1.1.1","release/coder/slackme/v1.0.32","release/coder/rstudio-server/v0.9.1","release/coder/personalize/v1.0.32","release/coder/mux/v1.0.2","release/coder/local-windows-rdp/v1.0.3","release/coder/kiro/v1.1.1","release/coder/kasmvnc/v1.2.6","release/coder/jupyterlab/v1.2.1","release/coder/jupyter-notebook/v1.2.1","release/coder/jfrog-token/v1.2.2","release/coder/jfrog-oauth/v1.2.3","release/coder/jetbrains/v1.2.1","release/coder/jetbrains-gateway/v1.2.6","release/coder/jetbrains-fleet/v1.0.2","release/coder/hcp-vault-secrets/v1.0.35","release/coder/goose/v3.0.1","release/coder/github-upload-public-key/v1.0.32","release/coder/git-config/v1.0.32","release/coder/git-commit-signing/v1.0.32","release/coder/git-clone/v1.2.1","release/coder/filebrowser/v1.1.3","release/coder/dotfiles/v1.2.2","release/coder/devcontainers-cli/v1.0.33","release/coder/cursor/v1.3.3","release/coder/coder-login/v1.1.1","release/coder/code-server/v1.4.1","release/coder/claude-code/v4.2.3","release/coder/amazon-q/v3.0.1","release/coder/aider/v2.0.1","release/coder-labs/sourcegraph-amp/v2.0.2","release/coder-labs/opencode/v0.1.1","release/coder-labs/nextflow/v0.9.1","release/coder-labs/gemini/v2.1.2","release/coder-labs/cursor-cli/v0.2.2","release/coder-labs/copilot/v0.2.3","release/coder-labs/codex/v3.1.1","release/coder-labs/auggie/v0.2.2","release/coder-labs/archive/v0.0.2","release/anomaly/tmux/v1.0.2","release/BenraouaneSoufiane/rustdesk/v1.0.1","release/AJ0070/pgadmin/v1.0.1","release/coder-labs/opencode/v0.1.0","release/coder/claude-code/v4.2.2","release/cytoshahar/positron/v1.0.0","release/coder/claude-code/v4.2.1","release/coder/mux/v1.0.1","release/coder/vault-token/v1.3.0","release/coder/vault-jwt/v1.2.0","release/coder/vault-github/v1.1.0","release/coder/claude-code/v4.2.0","release/coder/jfrog-oauth/v1.2.2","release/coder/claude-code/v4.1.0","release/coder/jfrog-token/v1.2.1","release/coder/jfrog-oauth/v1.2.1","release/coder/claude-code/v3.2.1","release/coder/mux/v1.0.0","release/coder/jetbrains/v1.2.0","release/coder/code-server/v1.4.0","release/coder/claude-code/v4.0.1","release/coder/amazon-q/v3.0.0","release/coder/goose/v3.0.0","release/coder/claude-code/v4.0.0","release/djarbz/copyparty/v1.0.1","release/coder/claude-code/v3.4.4","release/coder-labs/sourcegraph-amp/v2.0.1","release/coder/claude-code/v3.4.3","release/coder/windows-rdp/v1.3.0","release/coder/vault-token/v1.2.2","release/coder/jetbrains/v1.1.1","release/coder-labs/codex/v3.1.0","release/coder/claude-code/v3.3.3","release/coder/claude-code/v3.3.2","release/coder/claude-code/v3.3.1","release/coder/kasmvnc/v1.2.5","release/coder/aider/v2.0.0","release/coder/agentapi/v2.0.0","release/coder/claude-code/v3.3.0","release/djarbz/copyparty/v1.0.0","release/coder/zed/v1.1.1","release/coder/claude-code/v3.2.2","release/coder-labs/copilot/v0.2.2","release/coder/claude-code/v3.2.0","release/coder-labs/archive/v0.0.1","release/coder-labs/codex/v3.0.0","release/coder-labs/sourcegraph-amp/v2.0.0","release/coder-labs/sourcegraph-amp/v1.1.1","release/coder-labs/gemini/v2.1.1","release/coder-labs/cursor-cli/v0.2.1","release/coder-labs/auggie/v0.2.1","release/coder/git-clone/v1.2.0","release/coder/amazon-q/v2.1.1","release/coder/goose/v2.2.1","release/coder/claude-code/v3.1.1","release/coder-labs/codex/v2.1.1","release/coder/kasmvnc/v1.2.4","release/mavrickrishi/nexus-repository/v1.0.1","release/mavrickrishi/nexus-repository/v1.0.0","release/mavrickrishi/auto-start-dev-server/v1.0.1","release/coder/jetbrains-gateway/v1.2.5","release/coder/git-clone/v1.1.2","release/mavrickrishi/auto-start-dev-server/v1.0.0","release/coder-labs/copilot/v0.2.1","release/coder/goose/v2.2.0","release/coder/claude-code/v3.1.0","release/coder/amazon-q/v2.1.0","release/coder-labs/sourcegraph-amp/v1.1.0","release/coder-labs/gemini/v2.1.0","release/coder-labs/cursor-cli/v0.2.0","release/coder-labs/copilot/v0.2.0","release/coder-labs/codex/v2.1.0","release/coder-labs/auggie/v0.2.0","release/coder/agentapi/v1.2.0","release/coder-labs/copilot/v0.1.2","release/coder-labs/copilot/v0.1.1","release/coder/claude-code/v3.0.3","release/coder-labs/copilot/v0.1.0","release/coder/claude-code/v3.0.2","release/coder/jetbrains-gateway/v1.2.4","release/coder/jetbrains-gateway/v1.2.3","release/coder/claude-code/v3.0.1","release/BenraouaneSoufiane/rustdesk/v1.0.0","release/coder/jetbrains/v1.1.0","release/coder/kasmvnc/v1.2.3","release/coder/goose/v2.1.2","release/coder/claude-code/v3.0.0","release/coder-labs/nextflow/v0.9.0","release/coder/jfrog-token/v1.2.0","release/coder/jfrog-oauth/v1.2.0","release/coder/amazon-q/v2.0.0","release/coder-labs/sourcegraph-amp/v1.0.3","release/coder/jfrog-token/v1.1.0","release/coder/jfrog-oauth/v1.1.0","release/umair/digitalocean-region/v1.0.0","release/coder/rstudio-server/v0.9.0","release/AJ0070/pgadmin/v1.0.0","release/coder/coder-login/v1.1.0","release/coder/windsurf/v1.2.0","release/coder/kiro/v1.1.0","release/coder/cursor/v1.3.2","release/coder/claude-code/v2.2.0","release/mavrickrishi/aws-ami-snapshot/v1.0.0","release/coder-labs/gemini/v2.0.0","release/coder-labs/sourcegraph-amp/v1.0.2","release/coder-labs/sourcegraph-amp/v1.0.1","release/anomaly/tmux/v1.0.1","release/coder/jupyterlab/v1.2.0","release/coder-labs/auggie/v0.1.0","release/coder-labs/sourcegraph-amp/v1.0.0","release/coder-labs/codex/v2.0.0","release/coder/vscode-web/v1.4.1","release/coder/vscode-web/v1.4.0","release/coder/kasmvnc/v1.2.2","release/coder-labs/codex/v1.0.1","release/coder-labs/codex/v1.0.0","release/coder-labs/cursor-cli/v0.1.1","release/coder-labs/cursor-cli/v0.1.0","release/coder/claude-code/v2.1.0","release/coder/cursor/v1.3.1","release/coder/zed/v1.1.0","release/coder-labs/gemini/v1.1.0","release/coder/cursor/v1.3.0","release/coder/vscode-desktop-core/v1.0.0","release/coder/jetbrains/v1.0.3","release/coder/goose/v2.1.1","release/coder-labs/gemini/v1.0.1","release/coder/claude-code/v2.0.7","release/coder/agentapi/v1.1.1","release/coder/goose/v2.1.0","release/coder/jetbrains/v1.0.2","release/coder/agentapi/v1.1.0","release/coder/claude-code/v2.0.6","release/coder/devcontainers-cli/v1.0.32","release/coder/claude-code/v2.0.5","release/coder/amazon-q/v1.1.2","release/coder/aider/v1.1.2","release/coder/agentapi/v1.0.2","release/coder/hcp-vault-secrets/v1.0.34","release/coder/jupyter-notebook/v1.2.0","release/coder/claude-code/v2.0.4","release/coder-labs/gemini/v1.0.0","release/anomaly/tmux/v1.0.0","release/coder/zed/v1.0.1","release/coder/windsurf/v1.1.1","release/coder/windows-rdp/v1.2.3","release/coder/vscode-web/v1.3.1","release/coder/vscode-desktop/v1.1.1","release/coder/vault-token/v1.2.1","release/coder/vault-jwt/v1.1.1","release/coder/vault-github/v1.0.31","release/coder/slackme/v1.0.31","release/coder/personalize/v1.0.31","release/coder/local-windows-rdp/v1.0.2","release/coder/kasmvnc/v1.2.1","release/coder/jupyterlab/v1.1.1","release/coder/jupyter-notebook/v1.1.1","release/coder/jfrog-token/v1.0.31","release/coder/jfrog-oauth/v1.0.31","release/coder/jetbrains/v1.0.1","release/coder/jetbrains-gateway/v1.2.2","release/coder/hcp-vault-secrets/v1.0.33","release/coder/goose/v2.0.1","release/coder/github-upload-public-key/v1.0.31","release/coder/git-config/v1.0.31","release/coder/git-commit-signing/v1.0.31","release/coder/git-clone/v1.1.1","release/coder/gcp-region/v1.0.31","release/coder/fly-region/v1.0.31","release/coder/filebrowser/v1.1.2","release/coder/dotfiles/v1.2.1","release/coder/devcontainers-cli/v1.0.31","release/coder/cursor/v1.2.1","release/coder/coder-login/v1.0.31","release/coder/code-server/v1.3.1","release/coder/azure-region/v1.0.31","release/coder/aws-region/v1.0.31","release/coder/amazon-q/v1.1.1","release/coder/amazon-dcv-windows/v1.1.1","release/coder/aider/v1.1.1","release/coder/agentapi/v1.0.1","release/coder/claude-code/v2.0.3","release/coder/kiro/v1.0.0","release/coder/hcp-vault-secrets/v1.0.32","release/coder/hcp-vault-secrets/v1.0.31","release/coder/git-clone/v1.1.0","release/coder/jetbrains-fleet/v1.0.1","release/coder/dotfiles/v1.2.0","release/coder/jetbrains-fleet/v1.0.0","release/coder/goose/v2.0.0","release/coder/jetbrains/v1.0.0","release/coder/agentapi/v1.0.0","release/coder/claude-code/v2.0.2","release/coder/windows-rdp/v1.2.2","release/coder/local-windows-rdp/v1.0.1","release/coder/zed/v1.0.0","release/coder/jetbrains-gateway/v1.2.1","release/coder/filebrowser/v1.1.1","release/coder/claude-code/v2.0.1","release/coder/claude-code/v2.0.0","release/coder/claude-code/v1.4.0","release/coder/local-windows-rdp/v1.0.0","release/coder/vscode-web/v1.3.0","release/coder/windows-rdp/v1.2.1","release/coder/windows-rdp/v1.2.0","release/coder/windows-rdp/v1.1.0","release/coder/claude-code/v1.3.1","release/coder/windsurf/v1.1.0","release/coder/vscode-web/v1.2.0","release/coder/vscode-desktop/v1.1.0","release/coder/kasmvnc/v1.2.0","release/coder/jupyterlab/v1.1.0","release/coder/jupyter-notebook/v1.1.0","release/coder/jetbrains-gateway/v1.2.0","release/coder/goose/v1.3.0","release/coder/filebrowser/v1.1.0","release/coder/dotfiles/v1.1.0","release/coder/cursor/v1.2.0","release/coder/code-server/v1.3.0","release/coder/claude-code/v1.3.0","release/coder/amazon-q/v1.1.0","release/coder/amazon-dcv-windows/v1.1.0","release/coder/aider/v1.1.0","release/coder/kasmvnc/v1.1.0","release/coder/vault-token/v1.2.0","release/coder/jetbrains-gateway/v1.1.1","release/coder/goose/v1.2.0","release/coder/vscode-web/v1.1.0","release/coder/goose/v1.1.1","release/coder/code-server/v1.2.0","release/coder/amazon-q/v1.0.1","release/coder/aider/v1.0.1","release/coder/vault-token/v1.1.0","release/coder/cursor/v1.1.0","release/whizus/exoscale-zone/v1.0.13","release/whizus/exoscale-instance-type/v1.0.13","release/thezoker/nodejs/v1.0.11","release/nataindata/apache-airflow/v1.0.14","release/coder/amazon-q/v1.0.0","release/coder/aider/v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44454.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}