A vulnerability in Coder permits OS command injection, which could allow an attacker to achieve unauthorized remote code execution.

This vulnerability involves improper neutralization of special elements in output (CWE-74) and OS command injection (CWE-78). An unauthenticated attacker could leverage this flaw to execute arbitrary commands on the underlying system.

The exploitation of this vulnerability poses a severe risk to organizational infrastructure. With a CVSS score of 8.3, successful execution allows an attacker to compromise the confidentiality, integrity, and availability of the development environment, potentially leading to unauthorized data access or full system takeover.

Immediate Action: Upgrade to versions 2.34.2, 2.33.8, 2.32.7, or 2.29.17 immediately to apply the necessary patches.

Proactive Monitoring: Monitor system logs for unexpected process execution or anomalous shell activity originating from the Coder service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns.

Public Exploit Available: false

Given the high CVSS score and the nature of command injection, this vulnerability represents a significant security risk. Administrators must prioritize updating the Coder environment to the latest patched releases to mitigate the threat of remote code execution.