Coder’s config-ssh command writes server‑supplied SSH settings, such as HostnameSuffix and SSHConfigOptions, into a user’s ~/.ssh/config without filtering newlines or restricting directives. This flaw, identified as CWE‑74 and CWE‑78, enables a malicious or compromised Coder server to inject arbitrary SSH configuration, potentially leading to unauthorized modification of the client’s behavior and impacting the confidentiality or integrity of SSH sessions for any user who applies the generated configuration.

Deployments of the Coder platform using any released version older than v2.29.7, v2.32.7, v2.33.8, or v2.34.2 are affected. These versions are used by organizations provisioning remote development environments through Terraform. If the deployment’s HostnameSuffix or SSHConfigOptions values can be manipulated—by a compromised server, a man‑in‑the‑middle position, or administrative access—the injected directives will be written to the user’s configuration file.

The CVSS base score of 8.3 classifies the flaw as high severity. The EPSS score of <1% and absence from the CISA KEV catalog imply a low likelihood of exploitation in the wild. Exploitation requires an attacker to influence the server‑supplied values, typically through administrative control of the Coder deployment or a compromised server. Based on the description, it is inferred that injected configuration could alter the SSH client’s behavior for affected users, potentially compromising confidentiality or integrity of SSH sessions.