Repository navigation
Security: coder/code-server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unauthenticated remote code execution through the bundled Node.js Brotli decoder (CVE-2026-111497)GHSA-gcvg-jpfh-4xm8 published
Oct 28, 2026 by Lisa-FianderHigh -
Session cookie can be extracted by having user visit specially crafted proxy URLGHSA-p483-wpfp-42cj published
May 9, 2025 by code-asherHigh