【中危】v2 安全更新（GHSA-7qw2-f75v-62f7）

安全情报快照 · 风险级别：中危 · CVSS：5.4 · CVE-2026-55437 · GHSA-7qw2-f75v-62f7

先看结论

v2存在安全风险，>= 2.34.0, < 2.34.2 受影响，建议升级至 2.34.2。

影响范围

生态	组件	受影响版本	首个修复版本
go	`github.com/coder/coder/v2`	>= 2.34.0, < 2.34.2	2.34.2
go	`github.com/coder/coder/v2`	>= 2.33.0, < 2.33.8	2.33.8
go	`github.com/coder/coder/v2`	>= 2.30.0, < 2.32.7	2.32.7
go	`github.com/coder/coder/v2`	< 2.29.17	2.29.17

处置建议

优先将 github.com/coder/coder/v2 升级至 2.34.2 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

The AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

Note: Exploitation requires a victim to view attacker-controlled agent logs in the dashboard.

Impact

A user who could run a workspace could emit arbitrary HTML into agent logs; when another user, including an administrator, viewed the workspace page, it rendered in their session. Content Security Policy blocked inline scripts but an attacker could still inject a meta refresh redirect, style rules for UI redressing or CSS-based exfiltration or external img beacons. This required workspace-owner access and a victim viewing the page.

Patches

The fix enables escapeXML: true so HTML metacharacters are escaped before DOM insertion.

The fix was backported to all supported release lines:

Release line	Patched version
2.34	v2.34.2
2.33	v2.33.8
2.32	v2.32.7
2.29 (ESR)	v2.29.17

Workarounds

None.

Resources

Fix: #25808

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22449) for independently disclosing this issue!

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。