Skip to content
OpenAdvisories

Product · coder

code-server

1 known vulnerabilities.

All Critical High Medium Low Exploited only

1 result · Clear filters · Feed

  • High 8.3
    CVE-2025-47269 EPSS 56%

    code-server session cookie can be extracted by having user visit specially crafted proxy URL

    code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a pro…

    coder code-server code-server npm