GO-2026-5906
and 18 other vulnerabilities
GO-2026-5906 : Coder: User-admin role can reset owner account password in github.com/coder/coder
GO-2026-5907 : Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
GO-2026-5908 : Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder
GO-2026-5909 : Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder
GO-2026-5911 : Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder
GO-2026-5913 : Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder
GO-2026-5915 : Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder
GO-2026-5916 : Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder
GO-2026-5917 : Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder
GO-2026-5918 : Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder
GO-2026-5919 : Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder
GO-2026-5920 : Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder
GO-2026-5922 : Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder
GO-2026-5923 : Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder
GO-2026-5924 : Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder
GO-2026-5925 : Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder
GO-2026-5926 : Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder
GO-2026-6265 : Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
GO-2026-6267 : Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
Discover Packages
github.com/coder/coder/v2
coderd
coderdtest
promhelp
package
Version:
v2.32.4
Opens a new window with list of versions in this module.
Published: May 19, 2026
License: AGPL-3.0
Opens a new window with license information.
Imports: 12
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Jump to ...
Documentation
Overview
Index
Constants
Variables
Functions
Compare(reg, compare, metricNames)
CounterValue(t, reg, metricName, labels)
GaugeValue(t, reg, metricName, labels)
HistogramValue(t, reg, metricName, labels)
MetricValue(t, reg, metricName, labels)
RegistryDump(reg)
Types
Source Files
Documentation
¶
Package promhelp provides helper functions for asserting Prometheus
metric values in unit tests.
func Compare(reg prometheus.Gatherer, compare string, metricNames ...string) error
func CounterValue(t testing.TB, reg prometheus.Gatherer, metricName string, ...) int
func GaugeValue(t testing.TB, reg prometheus.Gatherer, metricName string, ...) int
func HistogramValue(t testing.TB, reg prometheus.Gatherer, metricName string, ...) *io_prometheus_client.Histogram
func MetricValue(t testing.TB, reg prometheus.Gatherer, metricName string, ...) *io_prometheus_client.Metric
func RegistryDump(reg *prometheus.Registry) string
Compare can be used to compare a registry to some prometheus formatted
text. If any values differ, an error is returned.
If metric names are passed in, only those metrics will be compared.
Usage: `Compare(reg, RegistryDump(reg))`
CounterValue returns the value of a counter metric with the given name and labels.
GaugeValue returns the value of a gauge metric with the given name and labels.
HistogramValue returns the value of a histogram metric with the given name and labels.
RegistryDump returns the http page for a given registry's metrics.
Very useful for visual debugging.
¶
Click to show internal directories.
Click to hide internal directories.
Affected by 
Documentation
¶
Source Files