Fluid Attacks Database

Description

Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/coder/coder/v2	>=2.22.0 <2.24.4 \|\| >=2.25.0 <2.25.2	2.24.4, 2.25.2
go	github.com/coder/coder	-	-

Aliases

1. CVE-2025-584372. NVD-2025-584373. OSV-2025-584374. OSV-GO-2025-39385. GHSA-j6xf-jwrj-v5qp6. GCVE-2025-584377. GHSA-j6xf-jwrj-v5qp

References

1. https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp2. https://github.com/coder/coder/pull/196673. https://github.com/coder/coder/pull/196684. https://github.com/coder/coder/pull/196695. https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c2766. https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc07. https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.