A flaw in Coder’s AgentLogLine dashboard component allows an attacker to embed arbitrary HTML or JavaScript into workspace agent logs that are displayed in the browser. The component employs the ansi‑to‑html library without escaping XML characters and injects the rendered output using dangerouslySetInnerHTML, so the log content is interpreted as live markup. This flaw, identified as CWE‑79, constitutes a stored cross‑site scripting vulnerability that can execute malicious scripts when a user views the affected logs.

The affected product is Coder by coder. Versions prior to 2.29.17, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. The issue is fixed in releases 2.29.17, 2.32.7, 2.33.8, 2.34.2 and all later versions.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% shows a very low overall exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker’s log content be viewable in the dashboard, meaning the compromise is limited to users who access those logs. No workarounds are available, so the only protection is the official patch.