CVE-2026-19284

MEDIUM 5.3

MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-77 CWE-74
Vendor	mauriciomilano
Product	coder-api
Published	Aug 8, 2026

Stay Ahead of the Next One

Get instant alerts for mauriciomilano coder-api

Be the first to know when new medium vulnerabilities affecting mauriciomilano coder-api are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

MauricioMilano / coder-api

1.0 1.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/387024 vuldb.com: https://vuldb.com/vuln/387024/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19284 vuldb.com: https://vuldb.com/submit/865227 github.com: https://github.com/MauricioMilano/coder-api/issues/9 github.com: https://github.com/MauricioMilano/coder-api/

Credits

🔍 gongyanyu02 (VulDB User) VulDB CNA Team