gitsafehub
github.com/coder/envbuilder ↗

coder/envbuilder

scanned 2026-08-12 · git 7ac38c1
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies74Known OSS vulnerabilities114Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found · 2 serious

API keys, passwords or tokens committed into the repo.

  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    git/git_test.go:506
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    integration/integration_test.go:66
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 74 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
    go.mod
    A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-50274 github.com/DataDog/dd-trace-go: Datadog dd-trace-go: Denial of Service via malicious baggage headers
    go.mod
    A package you depend on has a known security hole (CVE-2026-50274). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44454 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
    go.mod
    A package you depend on has a known security hole (CVE-2026-44454). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
    go.mod
    A package you depend on has a known security hole (CVE-2026-55075). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
    go.mod
    A package you depend on has a known security hole (CVE-2026-55076). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55077 Coder: User-admin role can reset owner account password
    go.mod
    A package you depend on has a known security hole (CVE-2026-55077). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
    go.mod
    A package you depend on has a known security hole (CVE-2026-55427). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
    go.mod
    A package you depend on has a known security hole (CVE-2026-55428). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
    go.mod
    A package you depend on has a known security hole (CVE-2026-55429). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
    go.mod
    A package you depend on has a known security hole (CVE-2026-55431). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
    go.mod
    A package you depend on has a known security hole (CVE-2026-55078). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55079 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
    go.mod
    A package you depend on has a known security hole (CVE-2026-55079). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
    go.mod
    A package you depend on has a known security hole (CVE-2026-55430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement
    go.mod
    A package you depend on has a known security hole (CVE-2026-55432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55433 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
    go.mod
    A package you depend on has a known security hole (CVE-2026-55433). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
    go.mod
    A package you depend on has a known security hole (CVE-2026-55437). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
    go.mod
    A package you depend on has a known security hole (CVE-2026-55438). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalation
    go.mod
    A package you depend on has a known security hole (CVE-2024-25621). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-46680 github.com/containerd/containerd: containerd: Privilege escalation via incorrect user ID handling
    go.mod
    A package you depend on has a known security hole (CVE-2026-46680). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53488 github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin
    go.mod
    A package you depend on has a known security hole (CVE-2026-53488). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53489 github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore
    go.mod
    A package you depend on has a known security hole (CVE-2026-53489). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53492 github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.
    go.mod
    A package you depend on has a known security hole (CVE-2026-53492). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks
    go.mod
    A package you depend on has a known security hole (CVE-2025-64329). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47262 github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing
    go.mod
    A package you depend on has a known security hole (CVE-2026-47262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-50195 github.com/containerd/containerd: containerd: Arbitrary code execution via CRI checkpoint image tag poisoning
    go.mod
    A package you depend on has a known security hole (CVE-2026-50195). Fix: Update that package to its patched version.
… 49 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 114 found · 9 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GO-2026-5338 containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-50195). Fix: Update that package to its patched version.
  • Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
  • Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
  • Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
  • Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
  • Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
  • Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
  • Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
  • Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-6000 Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-50274). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5897 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-44454). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5906 Coder: User-admin role can reset owner account password in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55077). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5907 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55076). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5908 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55075). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5909 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55429). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5911 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55079). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5913 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55427). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5915 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55428). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5916 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55078). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5917 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55430). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5918 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55438). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5919 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55437). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5922 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55433). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5924 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55431). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5926 Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder
    /workdirs/scan-a1890a25-2620-448c-8c50-2a326313f06e/go.mod
    A package you depend on has a known security hole (CVE-2026-55432). Fix: Update that package to its patched version.
… 89 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.