code-server

v4.124.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Editors & IDEs

✓ No known CVEs patched

This release patches 1 known CVE

Topics

browser-ide dev-tools development-environment ide remote-work vscode

+1 more

vscode-remote

Affected surfaces

auth

Summary

AI summary

Strip session token from cookies before proxying to prevent unauthorized login via malicious services.

Full changelog

Code v1.124.2

Strip code-server's session token from the cookie before proxying to a local
port. Previously, when you used built-in password authentication, the cookie
would be sent to the local proxied port, which meant if the service was
malicious and not already running as your code-server user it could use the
cookie to log into code-server and execute commands as your code-server user.

Strip code-server's session token from the cookie before proxying to a local port, preventing malicious services from using the cookie to log in and execute commands as the code-server user.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track code-server

Get notified when new releases ship.

About code-server

VS Code in the browser