An OS command injection vulnerability in Dokploy allows authenticated attackers to gain unauthorized command execution on the host system.

This vulnerability involves the improper neutralization of special elements used in an OS command (CWE-78). It requires the attacker to have low-level privileges to successfully inject and execute arbitrary commands.

Successful exploitation leads to full system compromise, as the attacker can execute arbitrary commands with the privileges of the Dokploy service. With a CVSS score of 8.7, this represents a significant risk of data exfiltration, service manipulation, and lateral movement within the environment.

Immediate Action: Update Dokploy to version 0.29.13 or later to apply the necessary security fixes.

Proactive Monitoring: Review audit logs for suspicious process execution or unexpected shell activity initiated by the Dokploy user account.

Compensating Controls: Ensure the Dokploy process runs with the least privilege necessary and utilize containerization or sandboxing to limit the scope of potential command execution.

Public Exploit Available: No (exploit_available: false)

The severity of this command injection flaw necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential full-system compromise.