25 lines
2.1 KiB
Markdown
25 lines
2.1 KiB
Markdown
# code-server — triage (group D)
|
|
Pin: lscr.io/linuxserver/code-server:4.129.0. Gates: none (code-server's own PASSWORD login is the only door).
|
|
|
|
## Notice: release:coder/code-server@v4.141.1 "Brotli decoder (CVE-2026-111497)" — REAL (bundled Node.js runtime + code-server change)
|
|
- It is a Node.js bug (Node Oct 21 2026 security release: Brotli decoder OOB write -> RCE, high; affects 22.x/24.x/26.x).
|
|
code-server ships its own Node in the release tarball; linuxserver's Dockerfile installs that tarball, so the image's
|
|
Node is code-server's. `.node-version`: v4.129.0 = 24.18.0 (affected), v4.141.1 and v4.143.1 = 24.22.1 (fixed).
|
|
- code-server itself also changed: "Reject compressed request bodies (br/gzip/deflate) instead of decompressing them"
|
|
(commit range touches routes/index.ts + login.test.ts). code-server uses express ^5 (body-parser 2 inflates br),
|
|
so a stranger's POST to /login with `Content-Encoding: br` reached the vulnerable decoder BEFORE authentication.
|
|
- Severity: high (RCE). Login: none (pre-auth path via body parsing — strongly indicated by the fix, not tested live).
|
|
Reachable: yes, public subdomain, no gate.
|
|
|
|
## Fix / target
|
|
Smallest fix: 4.141.1 (linuxserver tag `4.141.1` exists, 2026-10-23). Newest stable: v4.143.1 (after 4.141.1 in
|
|
CHANGELOG.md, same Node 24.22.1). TARGET: `lscr.io/linuxserver/code-server:4.143.1` (exists, 2026-10-24, = 4.143.1-ls373).
|
|
Same main: yes (4). Read all 16 releases 4.130.0..4.143.1:
|
|
- no data/file migration, no removed config, no new service. Behaviour changes: `--flag=false` in config now honoured
|
|
(4.141.1); compressed request bodies refused (4.141.1); proxy cookies passed unchanged (4.132.0); `--unsafe-perm`
|
|
removed from npm install scripts (4.134.0, not used by the image); 4.136.1 was withdrawn (data path bug) — skip it.
|
|
- VS Code core 1.129 -> 1.143 (14 upstream releases): extension compatibility is the main practical risk; not a breaking
|
|
change in the brief's sense. linuxserver: 20.09.26 IPv6 fallback only.
|
|
Lane: SECURITY_FIX (large gap; recommend the box walk opens a terminal + an extension after the move).
|
|
Classifier note: none (correct hit).
|