CRITICAL9.3npm
GHSA-frjg-g767-7363· CVE-2023-26114code-server vulnerable to Missing Origin Validation in WebSockets
Modified: 9/10/2026
package
npm/code-server
pkg:npm/code-server
MEDIUM6.1npm
GHSA-2gp3-6c9p-jp7w· CVE-2021-42648Cross site scripting in code-server
Modified: 9/10/2026
HIGH7.5npm
GHSA-49x3-8228-3w3m· CVE-2021-3810Inefficient Regular Expression Complexity in code-server
Modified: 9/10/2026
HIGH8.3npm
GHSA-p483-wpfp-42cj· CVE-2025-47269code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Modified: 9/10/2026