PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44454 coder CVE debrief

CVE-2026-44454 is a high-severity vulnerability in Coder, a tool for provisioning remote development environments via Terraform. The vulnerability exists in the dotfiles registry module, where unsanitized user input was passed to shell commands, allowing for arbitrary code execution within a provisioned workspace. An attacker could exploit this by crafting a malicious dotfiles URI, potentially leading to command execution in the workspace. This vulnerability was addressed in versions 2.29.7 and 2.30.2 of Coder, where input validation was added to reject URIs and usernames containing special characters, and unsafe eval/sh -c usage was removed.

Vendor
coder
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-07
Original CVE updated
2026-07-08
Advisory published
2026-07-07
Advisory updated
2026-07-08

Who should care

Users of Coder versions prior to 2.29.7 and 2.30.2 should be aware of this vulnerability and take immediate action to update their installations. Additionally, organizations using Coder for remote development environment provisioning should review their configurations and ensure that input validation is properly implemented.

Technical summary

The CVE-2026-44454 vulnerability in Coder arises from the dotfiles registry module's failure to properly sanitize user input. This allowed attackers to inject arbitrary shell commands, potentially leading to code execution within the workspace. The vulnerability was mitigated by adding input validation in versions 2.29.7 and 2.30.2, rejecting URIs and usernames with special characters and removing unsafe eval/sh -c usage.

Defensive priority

High

Recommended defensive actions

  • Update Coder to version 2.29.7 or 2.30.2
  • Review and validate user input for dotfiles URIs
  • Implement additional security measures to monitor and restrict shell commands
  • Conduct regular security audits and vulnerability assessments
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-44454 vulnerability was publicly disclosed on July 7, 2026. The NVD entry for this vulnerability was last modified on July 7, 2026. The vulnerability has a CVSS score of 8.1 and is classified as HIGH severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44454 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44454

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44454 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44454

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.