CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.
An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated DolphinScheduler user who can create a resource with a crafted filename and provide its path to the Alert Script plugin's /test-send endpoint can exploit it.
What access does successful exploitation provide?
Injected commands execute with the privileges of the DolphinScheduler service process. The issue relies on shell command substitution syntax in a resource filename, such as $(...).
Are default installations affected?
The available information identifies affected versions as those before 3.4.3, but does not state whether the Alert Script plugin or its /test-send endpoint is enabled by default.
What should be done if the deployment is vulnerable?
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue. Until upgrading, restrict access to authenticated users who can create resources and invoke the Alert Script plugin's /test-send endpoint.