Is github.com/coder/coder safe ? github.com/coder/coder (go) has 28 known vulnerabilities, the worst rated CRITICAL. No malicious-package signal is recorded.
// reach 309 direct dependencies
45 carry known advisories, worst CRITICAL
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 25th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-6x44-w3xg-hqqf, the advisory selected below
// 28 advisories GHSA-6x44-w3xg-hqqf azureidentity.Validate() verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. CRIT GHSA-m3cr-vc2j-pm27 The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. HIGH GHSA-7cc2-r658-7xpf A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not… HIGH GHSA-686c-7vgv-v3fx Unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). MODE GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder UNKN GHSA-h58c-xccx-75m3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder UNKN GHSA-qrwj-vh9x-gw5v Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder UNKN GHSA-x9qq-2qh5-8rxf Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder UNKN GHSA-wqxv-w64v-5wh6 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder UNKN GHSA-29xf-69gq-m9jx Coder: User-admin role can reset owner account password in github.com/coder/coder UNKN Show all 28 advisories azureidentity.Validate() verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None // questions Is github.com/coder/coder safe to install? CyberXYZ does not call a package safe in absolute terms. It records 28 known vulnerabilities for github.com/coder/coder (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/coder/coder have known vulnerabilities? Yes. CyberXYZ records 28 known vulnerabilities for github.com/coder/coder (go), the worst rated CRITICAL. These include GHSA-6x44-w3xg-hqqf, GHSA-m3cr-vc2j-pm27, GHSA-7cc2-r658-7xpf, GHSA-686c-7vgv-v3fx, GHSA-8fxq-53rx-ph5f.
How do I check github.com/coder/coder before installing? Search github.com/coder/coder in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fcoder%2Fcoder . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 09:51 UTC. The most recent advisory here was published 2026-08-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page