This vulnerability allows users with Owner privileges to store arbitrary HTML in the ApplicationName and LogoURL settings of Coder. The stored markup is rendered directly in the Coder dashboard and in SMTP notification emails sent to other deployment users without proper escaping. An attacker can deliver malicious scripts that run in the context of dashboard views, enabling data theft, phishing, or further exploitation against downstream receivers of the notification emails.

The affected product is Coder from the vendor coder. Versions prior to 2.34.2—including 2.29.17, 2.30.0 through 2.32.7, 2.33.0 through 2.33.8, and 2.34.0—are vulnerable. The vulnerability is present in any instance where Owner role permissions are granted to users who can modify these appearance settings.

With a CVSS score of 4.8, the risk is considered medium. The EPSS score is unavailable, and it is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. Because the flaw requires Owner access and affects rendering in both the front-end dashboard and email notifications, an attacker can potentially influence all users on the instance. Exploitation would involve navigating to the appearance settings, inserting malicious HTML, and subsequently triggering the rendering or email distribution.