← Vulnerability feed

Vulnerability record · CVE-2026-44454 · published 7 July 2026

CVE-2026-44454: Coder os command injection vulnerability

Coder · Coder

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation. In versions 2.29.7 and 2.30.2, input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminated the command injection at its source.

8.8 CVSS 3.1 High EPSS 2.6% · top 15.0% CWE-78 · OS command injection
8.8CVSS 3.1 base score
2.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
8 Jul 2026Last modified by NVD

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation. In versions 2.29.7 and 2.30.2, input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminated the command injection at its source.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb Patch
https://github.com/coder/coder/pull/22011 Issue TrackingPatch
https://github.com/coder/coder/releases/tag/v2.29.7 Release Notes
https://github.com/coder/coder/releases/tag/v2.30.2 Release Notes
https://github.com/coder/coder/security/advisories/GHSA-m3cr-vc2j-pm27 PatchVendor Advisory
https://github.com/coder/registry/commit/8e68c96633f65a1babd76a93b6923e3deead4a82 Patch
https://github.com/coder/registry/pull/703 Issue TrackingPatch

Track CVE-2026-44454 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-46354Coder improper verification of cryptographic signature vulnerabilityCoder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2,…EPSS 0.32%8.7CVE-2026-55429Coder insecure direct object reference vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertW…EPSS 0.51%8.3CVE-2026-55427Coder injection vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder c…EPSS 0.47%8.2CVE-2026-55428Coder improper authorization vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tail…EPSS 0.40%8.2CVE-2024-27918Coder improper input validation vulnerabilityCoder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in …EPSS 0.97%8.1CVE-2025-58437Coder insufficient session expiration vulnerabilityCoder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder ca…EPSS 0.38%7.4CVE-2026-55436Coder improper certificate validation vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.…EPSS 0.26%7.4CVE-2026-55076Coder improper authentication vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's …EPSS 0.61%

Source: NIST National Vulnerability Database (record CVE-2026-44454), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.