A critical command injection flaw in Dokploy enables authenticated users to execute arbitrary commands on the host or target server.

The application fails to sanitize Bitbucket owner and repository inputs before passing them to system commands. Authenticated users with service deployment permissions can inject malicious command arguments, leading to remote code execution on the host or target server.

This vulnerability is rated at 9.9 on the CVSS scale, indicating a critical risk of complete system compromise. Successful exploitation allows an attacker to execute arbitrary OS commands, leading to data exfiltration, service disruption, or lateral movement within the network.

Immediate Action: Update Dokploy to version 0.29.13 or later to implement the required input validation and secure command execution.

Proactive Monitoring: Monitor server logs for unexpected git commands or shell execution patterns. Audit the activities of users with service deployment permissions for anomalous behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and block suspicious input strings in API requests. Ensure that the application runs with strictly limited operating system privileges.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential unauthorized code execution by malicious or compromised internal accounts.