CRITICAL9.3

GHSA-frjg-g767-7363

code-server vulnerable to Missing Origin Validation in WebSockets

Quick fix

GHSA-frjg-g767-7363 — code-server: upgrade to the fixed version with the command below.

npm install code-server@4.10.1

Details

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/code-server

Introduced in: 0Fixed in: 4.10.1

Fixnpm install code-server@4.10.1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-26114[ADVISORY]
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7[WEB]
https://github.com/coder/code-server[PACKAGE]
https://github.com/coder/code-server/releases/tag/v4.10.1[WEB]
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148[WEB]