Code-server (Coder) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 33 known versions, newest CVE from 2025-05-09. Vendor: Coder.

CVEs of Code-server

• CVE-2025-47269 - CVSS 8.3 (high), 2025-05-09: code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result…
• CVE-2023-26114 - CVSS 9.3 (critical), 2023-03-23: Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can…
• CVE-2021-42648 - CVSS 6.1 (medium), 2022-05-11: Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.
• CVE-2021-3810 - CVSS 7.5 (high), 2021-09-17: code-server is vulnerable to Inefficient Regular Expression Complexity