GHSA-h58c-xccx-75m3: Anthropic Python stored HTML

Q: Is GHSA-h58c-xccx-75m3 actively exploited?

No confirmed active exploitation of GHSA-h58c-xccx-75m3 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-h58c-xccx-75m3?

Upgrade to the patched version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — apply via your standard Coder upgrade process. Until patched, restrict the Owner role to a minimal set of trusted administrators (the vendor's documented workaround) and audit current Owner-role assignments for unnecessary grants. Review the ApplicationName and LogoURL appearance settings for any unexpected markup as a compromise indicator, and consider auditing SMTP notification logs for anomalous content sent around the time any untrusted Owner account was provisioned.

Q: What systems are affected by GHSA-h58c-xccx-75m3?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

Q: What is the CVSS score for GHSA-h58c-xccx-75m3?

GHSA-h58c-xccx-75m3 has a CVSS v3.1 base score of 3.4 (LOW).

CISO Take

A stored HTML injection flaw in Coder's self-hosted dev-environment platform lets a user who already holds the highly privileged Owner role plant unescaped markup in the ApplicationName or LogoURL appearance fields, which then renders unsanitized in the admin dashboard and in SMTP notification emails sent to other users. The practical risk is limited precisely because exploitation requires an account that already has full administrative control of the deployment — there is no privilege escalation path here, and it was responsibly disclosed by Anthropic's Security Team rather than found in the wild. With CVSS 3.4 (low), no EPSS score published, no CISA KEV listing, and no public exploit or Nuclei template, this does not meet the bar for urgent action, but Coder is frequently used to provision isolated cloud workspaces for engineering and AI/agentic-coding teams, so a malicious or compromised Owner account could use injected HTML in outbound notification emails as a phishing vector against the rest of the org. Patch to the version matching your release line (2.34.2, 2.33.8, 2.32.7, or 2.29.17 for ESR) at your normal maintenance cadence, and in the interim ensure the Owner role is restricted to a small set of trusted, MFA-protected administrators per the vendor's stated workaround.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Low severity by design: AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N means the attacker must already possess Owner-level credentials (the highest privilege tier in Coder) and a victim must view the affected dashboard element or email. There is no confidentiality or availability impact, only limited integrity impact via injected markup. No KEV listing, no EPSS/SSVC data, and no public PoC or scanner template exist, indicating no observed or anticipated exploitation activity. The realistic threat model is an insider (malicious or compromised Owner account) using this as a phishing/social-engineering pivot against colleagues rather than an external attacker gaining new access.

How does the attack unfold?

Privileged Access

Attacker already holds or compromises an Owner-role account on a self-hosted Coder deployment, the prerequisite for exploitation.

Stored Injection

Attacker sets the ApplicationName or LogoURL appearance setting to contain unescaped HTML markup.

Delivery

The unsanitized markup renders in the admin dashboard viewed by other users and in outbound SMTP notification emails sent platform-wide.

AML.T0052

Impact

Recipients trust the branded, first-party-looking content and interact with embedded phishing links or deceptive elements, risking credential compromise.

Privileged Access

Attacker already holds or compromises an Owner-role account on a self-hosted Coder deployment, the prerequisite for exploitation.

Stored Injection

Attacker sets the ApplicationName or LogoURL appearance setting to contain unescaped HTML markup.

Delivery

The unsanitized markup renders in the admin dashboard viewed by other users and in outbound SMTP notification emails sent platform-wide.

AML.T0052

Impact

Recipients trust the branded, first-party-looking content and interact with embedded phishing links or deceptive elements, risking credential compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
4.0K6.3K dependentsPushed 8d ago93% patched~9d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

3.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRHigh

UIRequired

SChanged

CNone

ILow

ANone

What should I do?

1 step

Upgrade to the patched version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — apply via your standard Coder upgrade process. Until patched, restrict the Owner role to a minimal set of trusted administrators (the vendor's documented workaround) and audit current Owner-role assignments for unnecessary grants. Review the ApplicationName and LogoURL appearance settings for any unexpected markup as a compromise indicator, and consider auditing SMTP notification logs for anomalous content sent around the time any untrusted Owner account was provisioned.

How is it classified?

Social EngineeringCode ExecutionAgentAML.T0052- Phishing

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Annex A.6.2.4-AI system security controls

Frequently Asked Questions

What is GHSA-h58c-xccx-75m3?

A stored HTML injection flaw in Coder's self-hosted dev-environment platform lets a user who already holds the highly privileged Owner role plant unescaped markup in the ApplicationName or LogoURL appearance fields, which then renders unsanitized in the admin dashboard and in SMTP notification emails sent to other users. The practical risk is limited precisely because exploitation requires an account that already has full administrative control of the deployment — there is no privilege escalation path here, and it was responsibly disclosed by Anthropic's Security Team rather than found in the wild. With CVSS 3.4 (low), no EPSS score published, no CISA KEV listing, and no public exploit or Nuclei template, this does not meet the bar for urgent action, but Coder is frequently used to provision isolated cloud workspaces for engineering and AI/agentic-coding teams, so a malicious or compromised Owner account could use injected HTML in outbound notification emails as a phishing vector against the rest of the org. Patch to the version matching your release line (2.34.2, 2.33.8, 2.32.7, or 2.29.17 for ESR) at your normal maintenance cadence, and in the interim ensure the Owner role is restricted to a small set of trusted, MFA-protected administrators per the vendor's stated workaround.

Is GHSA-h58c-xccx-75m3 actively exploited?

No confirmed active exploitation of GHSA-h58c-xccx-75m3 has been reported, but organizations should still patch proactively.

How to fix GHSA-h58c-xccx-75m3?

Upgrade to the patched version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — apply via your standard Coder upgrade process. Until patched, restrict the Owner role to a minimal set of trusted administrators (the vendor's documented workaround) and audit current Owner-role assignments for unnecessary grants. Review the ApplicationName and LogoURL appearance settings for any unexpected markup as a compromise indicator, and consider auditing SMTP notification logs for anomalous content sent around the time any untrusted Owner account was provisioned.

What systems are affected by GHSA-h58c-xccx-75m3?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for GHSA-h58c-xccx-75m3?

GHSA-h58c-xccx-75m3 has a CVSS v3.1 base score of 3.4 (LOW).

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0052Phishing

Compliance Controls Affected

ISO 42001: Annex A.6.2.4

What are the technical details?

Original Advisory

### Summary The `ApplicationName` and `LogoURL` appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. > **Note:** Exploitation requires the `Owner` role which already holds full administrative control of the deployment so practical impact is limited. ### Impact An Owner-role user could store HTML markup in the `ApplicationName` or `LogoURL` appearance settings that later rendered in the dashboard and in SMTP notification emails which results in stored HTML injection against other users of the deployment. Exploitation requires the highly privileged `Owner` role. ### Patches The fix escapes the `ApplicationName` and `LogoURL` appearance values in HTML output before rendering. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict the `Owner` role to trusted administrators. ### References - Fix: #25804 ### Credits We'd like to thank Anthropic's Security Team (ANT-2026-22453) for independently disclosing this issue!

Exploitation Scenario

A malicious or compromised Owner-role administrator on a self-hosted Coder deployment sets the ApplicationName or LogoURL field to a string containing crafted HTML (e.g., a fake urgent security notice with an embedded credential-harvesting link). This markup is not escaped when rendered, so it appears as legitimate branded content both in the admin dashboard viewed by other privileged users and in routine SMTP notification emails sent to the broader engineering team, including those who provision or manage AI/agentic coding workspaces. Recipients, trusting the email as coming from their internal dev-platform, click the embedded link, leading to credential theft or further lateral movement — despite the attacker never having escalated privileges beyond what they already held.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Primary

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.