EUVD-2026-54784
GHSA-745r-gxf5-fh45
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges required per description; no scope change; all impacts limited to low severity within the application context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.
Technical ContextAI
The affected component is the createProject function located in src/core/projects.ts, part of the Projects Endpoint in MauricioMilano coder-api. CWE-77 (Improper Neutralization of Special Elements used in a Command, or 'Command Injection') identifies the root cause: user-controlled input is passed to a system shell or command execution routine without proper sanitization or escaping of metacharacters. This class of flaw allows attackers to break out of the intended command context by injecting shell operators (e.g., semicolons, pipes, backticks, or ampersands) that cause additional unintended commands to execute. The CPE cpe:2.3:a:mauriciomilano:coder-api:*:*:*:*:*:*:*:* confirms all versions up to 1.1.0 are affected. The attack surface is constrained to local execution contexts, consistent with the CVSS 4.0 AV:L designation.
RemediationAI
No vendor-released patch identified at time of analysis; the project was notified via GitHub issue (https://github.com/MauricioMilano/coder-api/issues/9) but has not responded. Users should monitor the repository at https://github.com/MauricioMilano/coder-api/ for a fix and upgrade immediately upon release. As a compensating control, restrict local system access to only trusted users who require the coder-api functionality, reducing the pool of potential attackers with PR:L access. Additionally, wrap the coder-api process in an OS-level sandbox (e.g., Linux namespaces, seccomp profiles, or a restricted user account with minimal filesystem permissions) to contain the impact of any command injection to a confined context; the trade-off is increased operational complexity. Review and harden the createProject input path by sanitizing or allowlist-validating project name inputs before passing them to any shell-invocation call, if source modification is feasible in your environment.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today