CVE-2023-26114

—

CVSS 3.1

9.3 critical

EPSS

<1%p27

Published

Mar 23, 2023 (Mar 23, 2023)

Modified

Jun 17, 2026

Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Vendors: coder
Products: code-server
Weakness: CWE-1385, CWE-346
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.