CVE-2025-47269
1 advisory.
npm/code-server CVE-2025-47269: high 8.3, EPSS 44.54%
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Action: Upgrade code-server to 4.99.4 or later.
npm i code-server@4.99.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.99.4 | - |
Fixed versions
| 4.99.4 |
Sources
- osv: GHSA-p483-wpfp-42cj
- https://github.com/coder/code-server/security/advisories/GHSA-p483-wpfp-42cj
- https://nvd.nist.gov/vuln/detail/CVE-2025-47269
- https://github.com/coder/code-server/commit/47d6d3ada5aadef6d221f3d612401eb3dad9299e
- https://github.com/coder/code-server
- https://github.com/coder/code-server/releases/tag/v4.99.4
CVE-2025-47269 · published · modified · JSON