CVE-2021-42648

Coder Code-Server is affected by a Cross-Site Scripting (XSS) vulnerability in versions before 3.12.0, exploitable via crafted URLs. Affected component: code-server frontend handling error messages; root cause: insufficient escaping of user-supplied input in error handling. Impact: arbitrary code...

CVE-2021-3810

CVE-2021-3810: code-server is vulnerable to Inefficient Regular Expression Complexity. The CVE has a high base impact (CVSS v3.1: 7.5, NETWORK, LOW attack complexity, no user interaction) in the NVD/NVDC entries; other mirrors (OSV, Red Hat, GHSA) corroborate the same issue. The connected records...

CVE-2023-26114

CVE-2023-26114 affects code-server prior to version 4.10.1. The vulnerability is Missing Origin Validation in WebSocket handshakes, which could allow an attacker in certain scenarios to access data from and connect to a code-server instance. Exploitation context and impact are described in the CV...