GHSA-frjg-g767-7363

code-server vulnerable to Missing Origin Validation in WebSockets

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-26114

Packages

Ecosystem	Package	Affected	Fixed in
npm	code-server	< 4.10.1	4.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26114 advisory
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 web
https://github.com/coder/code-server package
https://github.com/coder/code-server/releases/tag/v4.10.1 web
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 web