coder code-server vulnerabilities

Latest coder code-server CVEs

Newest publication first

1. CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL

   Published 2025-05-09

   High·CVSS 8.3

   code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.