{"id":"GHSA-mcqq-fqgf-rxwm","summary":"Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`","details":"### Summary\n\n`coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration.\n\n\u003e **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings.\n\n### Impact\n\nA server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces.\n\n### Patches\n\nThe fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nInspect `coder config-ssh --dry-run` output before applying changes.\n\n### Resources\n\n- Fix: #26154\n\n### Credits\n\nCoder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!","aliases":["CVE-2026-55427","GO-2026-5913"],"modified":"2026-08-24T00:36:58.919775418Z","published":"2026-07-06T20:53:54Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-74","CWE-78"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-06T20:53:54Z"},"references":[{"type":"WEB","url":"https://github.com/coder/coder/security/advisories/GHSA-mcqq-fqgf-rxwm"},{"type":"WEB","url":"https://github.com/coder/coder/pull/26154"},{"type":"PACKAGE","url":"https://github.com/coder/coder"}],"affected":[{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.34.0"},{"fixed":"2.34.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.33.0"},{"fixed":"2.33.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.30.0"},{"fixed":"2.32.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.29.17"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mcqq-fqgf-rxwm/GHSA-mcqq-fqgf-rxwm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}