CVE-2026-45408

Katalog CVE

CVSS 9.0 · Critical EPSS 0,42%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada dokku. Skor CVSS 3.1 9.0 (Critical) menurut github.com.

Deskripsi (NVD)

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dokku/dokku/security/advisories/GHSA-9x85-7gxq-fcr3 advisory vendor
• https://github.com/dokku/dokku/pull/8590 issue tracking · patch