An OS command injection vulnerability in Dokploy allows authenticated organization members to achieve root-level code execution, posing a critical risk to the host environment.

The flaw exists in the patch.readRepoDirectories tRPC procedure, which fails to properly sanitize user-controlled input before passing it to a shell command. An authenticated user with read permissions can leverage this to execute arbitrary commands, and because the container typically mounts the Docker socket, this access can be escalated to control the underlying host.

The ability to execute arbitrary commands as root constitutes a complete compromise of the affected application and its host infrastructure. Given the CVSS score of 9.9, this vulnerability represents an extreme risk, as it allows attackers to bypass security boundaries, manipulate managed applications, and steal sensitive data. The potential for lateral movement from the container to the host environment makes immediate remediation essential to prevent catastrophic system failure or data breach.

Immediate Action: Upgrade Dokploy to version 0.29.13 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for suspicious tRPC requests and monitor for anomalous child processes or shell execution events within the Dokploy container environment.

Compensating Controls: Restrict access to the Dokploy dashboard to trusted personnel only and consider implementing network-level access controls to limit the exposure of the management interface.

Public Exploit Available: Unknown.

Due to the critical nature of this vulnerability and the potential for full host system compromise, administrators must prioritize the update to version 0.29.13. Organizations should treat this as a high-priority task, ensuring all instances are patched and verifying that the Docker socket is not unnecessarily exposed or accessible to unauthorized users.