Critical severityNVD Advisory· Published Mar 23, 2023· Updated Feb 25, 2025

CVE-2023-26114

Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
code-servernpm	< 4.10.1	4.10.1

Affected products

code-server/code-serverdescription
osv-coords5 versions
pkg:apk/chainguard/code-server pkg:apk/chainguard/code-server-compat pkg:apk/wolfi/code-server pkg:apk/wolfi/code-server-compat pkg:npm/code-server
< 0+ 4 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 4.10.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-frjg-g767-7363ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-26114ghsaADVISORY
github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7ghsaWEB
github.com/coder/code-server/releases/tag/v4.10.1ghsaWEB
security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000