CVE-2026-44454: Coder Dotfiles Command Injection RCE – Patch Now

Technical summary

The vulnerability stems from OS command injection in the dotfiles registry module (CWE-78). The module accepted user-supplied `dotfiles_uri` values and passed them unsanitized to shell commands via `eval` or `sh -c` constructs. An attacker could embed command substitution syntax (e.g., `$(malicious_command)`) in the URI parameter. The attack surface was widened by Coder's `mode=auto` deep-link feature, which allowed URL prefilling of `param.dotfiles_uri` and automatic workspace provisioning without explicit user interaction. Versions 2.29.7 and 2.30.2 remediate the issue through input validation (rejecting special characters in URIs and usernames) and removal of unsafe shell evaluation patterns.

Business impact

This vulnerability enables direct code execution within provisioned development environments. An attacker could steal credentials, inject malware, exfiltrate source code, or establish persistence. The one-click attack mechanism means non-technical users could be compromised via deceptively crafted links, lowering the barrier to initial compromise. Organizations using Coder for distributed development teams face heightened risk of lateral movement and supply-chain attacks if development environments are trusted jump points to production infrastructure.

Affected systems

Coder versions prior to 2.29.7 and 2.30.2 are vulnerable. Organizations should verify their deployed Coder version and apply patches immediately. Environments provisioned with untrusted dotfiles URIs or accessed via user-generated links are at highest risk.

Exploitability

Exploitation requires only network access and a single user click. No authentication is required if the attacker can socially engineer a victim into clicking a malicious link. The `mode=auto` feature removes friction by automating workspace creation, making this a practical attack vector against even security-conscious users. The CVSS score of 8.1 (HIGH) reflects the combination of remote exploitability, low complexity, and no privilege requirement, though impact is limited to the individual workspace and does not directly affect confidentiality of other systems.

Remediation

Upgrade to Coder 2.29.7, 2.30.2, or later. These versions introduce input validation to reject dotfiles URIs and usernames containing shell metacharacters, and replace unsafe `eval`/`sh -c` patterns with safer alternatives. After patching, review and revoke any suspicious workspace provisioning activity in audit logs and inspect development environments for unauthorized code or persistence mechanisms.

Patch guidance

Apply Coder updates 2.29.7 or 2.30.2 or later according to your release branch. Test patches in a non-production environment first. Verify the dotfiles module is properly updated by checking module checksums or version tags in your Terraform registry. Consult Coder's official release notes to confirm all security changes are in place.

Detection guidance

Monitor Coder audit logs for workspace creation events with unusual or specially crafted `dotfiles_uri` parameters (containing `$`, backticks, or other shell metacharacters). Look for `mode=auto` deep-link accesses from external or suspicious sources. Search workspace provisioning logs for failed input validation errors post-patch, which may indicate attempted exploitation. Review Git or registry access logs for unauthorized pulls or pushes coinciding with workspace creation. Inspect running processes within provisioned workspaces for unexpected child processes or network connections.

Why prioritize this

HIGH priority. The vulnerability combines unauthenticated remote code execution, low attack complexity, and a user-friendly attack vector that bypasses explicit confirmation. While impact is scoped to individual workspaces, compromise of development environments can serve as a foothold for broader infrastructure attacks. Patching is straightforward and should be expedited, especially for internet-facing Coder instances.

Risk score, explained

CVSS 8.1 reflects a remote, unauthenticated attack with low complexity and no special conditions required. High confidentiality and integrity impact within the workspace justifies the elevated score. Availability impact is rated as none because command execution does not inherently stop the workspace from running. The score appropriately captures the practical risk from the one-click attack mechanism, though it does not account for downstream organizational damage if the development environment is trusted infrastructure.

Frequently asked questions