{"id":"CVE-2026-45628","aliases":["EUVD-2026-33360","GHSA-3frc-cfh9-ch2c"],"status":"published","title":"Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline","description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0023,"percentile":0.13903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-77"],"published":"2026-05-29T16:33:23Z","modified":"2026-10-28T02:30:33Z","products":[{"vendor":"dokploy","product":"dokploy"}],"references":[{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-3frc-cfh9-ch2c","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45628.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45628","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45628","title":"Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline","description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.","status":"published","published":"2026-05-29T16:33:23.681Z","modified":"2026-05-29T19:29:45.302Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-33360","description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.","status":"published","published":"2026-05-29T16:33:23Z","modified":"2026-05-29T19:29:45Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:21:00.384456Z"}],"nvd":[{"id":"CVE-2026-45628","description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.","status":"published","published":"2026-05-29T18:17:10.807Z","modified":"2026-10-06T22:10:00.247Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-45628","title":"Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline","description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.","status":"published","published":"2026-05-29T16:33:23.681Z","modified":"2026-10-28T02:30:33.085043438Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T15:45:05.525666Z"}]}}