CVE-2026-45628: Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via childprocess.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify Dokploy so that user-supplied branch names, repository URLs, and Docker credentials are not interpolated directly into shell commands executed via child_process.exec()/"/bin/sh -c". Validate and sanitize these inputs and avoid constructing commands with JavaScript template literals that include unescaped user data; instead pass safe, validated arguments or otherwise ensure proper escaping before invocation.
Dokploy (deployment pipeline) shell command construction = do not interpolate unescaped user input - Compensating control
Restrict which authenticated users have application create/edit privileges to trusted personnel only. Audit and monitor accounts with create/edit privileges and limit assignment of those privileges to reduce the risk surface (vulnerability requires an authenticated user with application create/edit privileges).
- Operational
Rotate any Docker credentials, repository tokens, or other secrets that were entered into Dokploy application fields and might have been exposed or injected. Review recent application create/edit actions for suspicious activity and remediate any unauthorized deployments.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45628?
The severity of CVE-2026-45628 is critical with a score of 9.6.
How do I fix CVE-2026-45628?
To fix CVE-2026-45628, upgrade to Dokploy version 0.29.3 or later where the command injection vulnerability is addressed.
What type of vulnerability is identified in CVE-2026-45628?
CVE-2026-45628 is identified as a command injection vulnerability due to improper input validation.
What can be exploited in CVE-2026-45628?
CVE-2026-45628 can be exploited through unescaped branch fields in the deployment pipeline, allowing attackers to execute arbitrary commands.
Which version of Dokploy is affected by CVE-2026-45628?
Dokploy versions 0.29.2 and earlier are affected by CVE-2026-45628.