CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable to command injection due to insufficient sanitization of user input in the `sanitizeCommand` function, allowing authenticated users to inject shell metacharacters. This vulnerability can lead to the execution of arbitrary commands on the Dokploy host, posing a significant security risk. Organizations using Dokploy should prioritize upgrading to version 0.29.13 to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.