An authenticated OS command injection vulnerability in Dokploy allows malicious actors to execute arbitrary code on build hosts, leading to full system compromise.

This vulnerability involves improper neutralization of special elements used in OS commands within the buildRemoteDocker function. An attacker with application management privileges can inject shell commands through the dockerImage parameter to achieve remote code execution.

Successful exploitation allows an authenticated attacker to gain control over the build host or remote SSH build targets. This compromise can lead to the theft of sensitive host secrets, unauthorized access to other projects, and a complete breach of the development environment. Given the critical CVSS score of 9.6, the potential for lateral movement and total system control represents a severe risk to organizational operations.

Immediate Action: Upgrade to Dokploy version 0.29.13 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system and application logs for suspicious command execution patterns or unauthorized modifications to build configurations.

Compensating Controls: Implement strict access control policies to limit the number of users with application creation and update permissions.

Public Exploit Available: No

The vulnerability poses a critical threat to the security of the build infrastructure. IT administrators must prioritize updating the Dokploy installation to version 0.29.13 to prevent exploitation of this command injection vector.