CVE-2026-45628
Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.6EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
29 May 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
Dokploy · dokployWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →