The flaw is an OS Command Injection arising from unsanitized dotfiles_uri values supplied to shell commands during workspace provisioning. A crafted URI that includes command substitution syntax (for example, $(…)) allows an attacker to execute arbitrary shell commands inside the new workspace, compromising the environment and potentially the underlying host.

Installing Coder versions prior to 2.29.7 the 2.29.x line or prior to 2.30.2 in the 2.30.x line, when the dotfiles registry module is enabled, is affected. Users who can create workspaces through the web interface and who could receive mode=auto deep links are at risk. The issue is fixed in releases 2.29.7 and 2.30.2 onward.

The CVSS score of 8.1 indicates high severity, and the EPSS score of 1% indicates a lower exploitation probability. Because no explicit user confirmation is required—an attacker can simply send a link that pre‑populates dotfiles_uri—the barrier to attack is low. While the vulnerability is not yet listed in CISA’s KEV catalog, the combination of a high severity, likely URL‑based attack vector, and the ability to run arbitrary commands in a provisioned workspace makes remediation a priority.