CVE-2026-118687

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118687", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-28T17:31:29.498Z", "datePublished": "2026-10-28T18:59:56.265Z", "dateUpdated": "2026-10-29T20:54:16.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T18:59:56.265Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication", "descriptions": [{"lang": "en", "value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unintended Proxy or Intermediary ('Confused Deputy')", "cweId": "CWE-441", "type": "CWE"}]}], "affected": [{"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.37.0", "status": "affected", "versionType": "semver", "lessThan": "2.37.4"}, {"version": "2.37.4", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.36.0", "status": "affected", "versionType": "semver", "lessThan": "2.36.7"}, {"version": "2.36.7", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.35.0", "status": "affected", "versionType": "semver", "lessThan": "2.35.9"}, {"version": "2.35.9", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.30.0", "status": "affected", "versionType": "semver", "lessThan": "2.34.12"}, {"version": "2.34.12", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.29.21"}, {"version": "2.29.21", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.37.0", "versionEndExcluding": "2.37.4"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.36.0", "versionEndExcluding": "2.36.7"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.35.0", "versionEndExcluding": "2.35.9"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.30.0", "versionEndExcluding": "2.34.12"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.29.21"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-24vh-q7rg-243w)"}, {"name": "VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication"}], "credits": [{"lang": "en", "value": "matte1782", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:28:59.226439Z", "id": "CVE-2026-118687", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T20:54:16.473Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118687", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:28:59.226439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:29:03.901Z"}}], "cna": {"title": "Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication", "credits": [{"lang": "en", "type": "reporter", "value": "matte1782"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.37.0", "lessThan": "2.37.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.37.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.36.0", "lessThan": "2.36.7", "versionType": "semver"}, {"status": "unaffected", "version": "2.36.7", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.35.0", "lessThan": "2.35.9", "versionType": "semver"}, {"status": "unaffected", "version": "2.35.9", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.30.0", "lessThan": "2.34.12", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.12", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.21", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.21", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}], "datePublic": "2026-10-13T00:00:00.000Z", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w", "name": "GitHub Security Advisory (GHSA-24vh-q7rg-243w)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication", "name": "VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.37.4", "versionStartIncluding": "2.37.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.36.7", "versionStartIncluding": "2.36.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.35.9", "versionStartIncluding": "2.35.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.34.12", "versionStartIncluding": "2.30.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.29.21"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T18:59:56.265Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118687", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:54:16.473Z", "dateReserved": "2026-10-28T17:31:29.498Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-28T18:59:56.265Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.37.4", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.37.4", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.36.7", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.36.7", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.35.9", "status": "affected", "version": "2.35.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.35.9", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.34.12", "status": "affected", "version": "2.30.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.12", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.29.21", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.21", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build."}], "id": "CVE-2026-118687", "lastModified": "2026-10-29T21:17:16.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118687", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:28:59.226439Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:35.807", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/coder/coder: coder: unauthorized session access via missing JWT audience validation", "id": "2563145", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563145"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-294", "details": ["Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.", "A flaw was found in Coder. The application fails to properly validate the audience claim in Google Compute Engine (GCE) instance-identity JSON Web Tokens (JWT) during workspace agent authentication. A remote attacker who obtains an unexpired token issued for another service can replay it to obtain a workspace agent session token, resulting in unauthorized access to the workspace environment."], "name": "CVE-2026-118687", "public_date": "2026-10-28T18:59:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118687\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118687\nhttps://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w\nhttps://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication"], "statement": "This vulnerability has been rated as Moderate because exploitation requires the prerequisite acquisition of an unexpired Google Cloud identity token intended for another relying party. Red Hat products do not distribute or package Coder, meaning standard Red Hat Enterprise Linux and OpenShift environments are not exposed to this flaw. In environments where third-party Coder instances are deployed on Google Compute Engine, the blast radius is constrained to workspace agent sessions until the next workspace build.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.37.0,2.37.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.37.4"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.36.0,2.36.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.36.7"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.35.0,2.35.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.35.9"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.30.0,2.34.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.34.12"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.29.21)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.29.21"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}], "created": "2026-10-28T22:30:12.257107+00:00", "updated": "2026-11-06T02:45:07.230302+00:00", "vendors": ["coder", "coder$PRODUCT$coder"]}