What’s Vulnerable › Products

code-server vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your code-server version is affected

Latest code-server vulnerabilities

• CVE-2025-47269 — code-server session cookie can be extracted by having user visit specially crafted proxy URL (CVSS 8.3)
• CVE-2023-26114 — (CVSS 9.3)
• CVE-2021-42648 — (CVSS 6.1)
• CVE-2021-3810 — Inefficient Regular Expression Complexity in cdr/code-server (CVSS 7.5)