Critical severity · published Mar 23, 2023
CVE-2023-26114
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Code-server · Coder
before 4.10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26114
Patch
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7
Release Notes
https://github.com/coder/code-server/releases/tag/v4.10.1
Patch
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
More from Code-server
8.3
CVE-2025-47269
code-server session cookie can be extracted by having user visit specially crafted proxy URL
7.5
CVE-2021-3810
code-server is vulnerable to Inefficient Regular Expression Complexity
6.1
CVE-2021-42648
Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL