EUVD-2026-39801Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Authenticated push user is required (PR:L), attacker self-triggers so UI:N, scope changes (S:C) as code runs as the privileged dokku user with full RCE impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.
Articles & Coverage 1
AnalysisAI
OS command injection in Dokku (the Docker-powered self-hosted PaaS) prior to version 0.38.2 allows an authenticated user with git push access to execute arbitrary shell commands as the privileged dokku user. The flaw stems from a permissive app-name validation regex that accepts shell metacharacters, which are then interpolated unquoted into a generated bash pre-receive hook; a semicolon in the app name terminates the intended command and runs attacker-supplied commands on git push. There is no public exploit identified at time of analysis, but the fix is confirmed in 0.38.2 and the underlying mechanics are fully documented in the GitHub advisory and PR #8590.
Technical ContextAI
Dokku generates per-app git server-side hooks to drive its push-to-deploy workflow. The vulnerable code path is fn-git-create-hook() in plugins/git/internal-functions:378, which builds a bash pre-receive script by embedding the app name into an unquoted heredoc (<<EOF rather than <<'EOF'). Because the heredoc is unquoted, bash performs expansion/parsing on the interpolated app name at hook-generation/execution time. The root cause (CWE-78, OS Command Injection) is upstream input validation: IsValidAppName used the regex ^[a-z0-9][^/:_A-Z]*$, a negated character class that only excluded slashes, colons, underscores, and uppercase letters while still permitting dangerous characters such as ;, $, `, |, &, >, and spaces. The fix in PR #8590 replaces this with an allow-list regex (^[a-z0-9][a-z0-9.-]*$ for the new validator, ^[a-z0-9][a-z0-9._-]*$ for the legacy variant) and centralizes validation in a Go helper (common is-valid-app-name) invoked from the shell layer, with new tests explicitly rejecting shell metacharacters. Affected CPE: cpe:2.3:a:dokku:dokku:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: 0.38.2 - upgrade Dokku to 0.38.2 or later, which replaces the negated-character-class regex with strict allow-list app-name validation and routes shell-layer checks through the hardened Go validator. Apply the upgrade per the advisory at https://github.com/dokku/dokku/security/advisories/GHSA-9x85-7gxq-fcr3 (fix in https://github.com/dokku/dokku/pull/8590). If immediate upgrade is not possible, restrict who can create apps and push to git remotes to fully trusted operators only, and audit existing app names for shell metacharacters (semicolons, backticks, $, |, &, spaces) before they are used to generate hooks; on multi-tenant instances, treat any push-capable account as having potential command execution and remove untrusted access. As a stopgap you can enforce app names manually against the safe pattern ^[a-z0-9][a-z0-9.-]*$ in your provisioning automation, accepting the trade-off that legitimate names using underscores will be rejected. These controls reduce exposure but do not close the underlying injection - upgrading is the only complete fix.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today