Description
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-08
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The createProject function in coder‑api allows a local user to inject arbitrary system commands. The flaw stems from interpreting unsanitized input as part of the command line, matching CWE‑74 and CWE‑77. An attacker who can execute code on the host can run arbitrary commands with the permissions of the coder‑api process, leading to potential system compromise.

Affected Systems

This bug affects MauricioMilano’s coder‑api component up to version 1.1.0. Any installation of coder‑api v1.1.0 or earlier that exposes the createProject endpoint is vulnerable.

Risk and Exploitability

The CVSS score is 4.8, indicating a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attack vector is local; an attacker needs access to the host running coder‑api. Because there is no patch yet, the current risk remains passive until remedied.

Generated by OpenCVE AI on August 8, 2026 at 14:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade coder‑api to a released version that addresses the command injection in createProject. Check the upstream repository for a patched release and apply it.
  • Restrict local access to coder‑api to trusted users, and enforce authentication and authorization so that only authorized users can call the createProject endpoint.
  • Disable or remove the createProject endpoint if the functionality is not required, or replace it with a safe implementation that properly sanitizes inputs.
  • Monitor server logs for unexpected calls to the endpoint and for signs of injected commands.

Generated by OpenCVE AI on August 8, 2026 at 14:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.
Title MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection
First Time appeared Mauriciomilano
Mauriciomilano coder-api
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:mauriciomilano:coder-api:*:*:*:*:*:*:*:*
Vendors & Products Mauriciomilano
Mauriciomilano coder-api
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mauriciomilano Coder-api
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-08T12:30:09.643Z

Reserved: 2026-08-07T15:35:32.401Z

Link: CVE-2026-19284

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T14:45:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')