Detections
Analytics

SCA: security update for code-server (GHSA-p483-wpfp-42cj)

high Tenable Self-Hosted Container Security Plugin ID 425955

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a
 maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session
 token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary
 domain. The malicious URL `https://<code-server>/proxy/[email protected]/path` would be proxied to
 `[email protected]/path` where the attacker could exfiltrate a user's session token. Any user who runs code-
 server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-
 server instances with reference to /proxy. Normally this is used to proxy local ports, however the URL can
 reference the attacker's domain instead, and the connection is then proxied to that domain, which will
 include sending cookies. With access to the session cookie, the attacker can then log into code-server and
 have full access to the machine hosting code-server as the user running code-server. This issue has been
 patched in version 4.99.4. (CVE-2025-47269)

See Also

https://github.com/advisories/GHSA-p483-wpfp-42cj

Plugin Details

Severity: High

ID: 425955

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 5/10/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.39

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2025-47269

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/9/2025

Vulnerability Publication Date: 5/9/2025

Reference Information

CVE: CVE-2025-47269

cwe: CWE-441