GHSA-wm5j-x54v-3fjf

Three separate injection points in Dokploy's application deployment pipeline use shell single-quote context or unquoted interpolation when writing to remote servers. Each has a safe local code path but a vulnerable remote path (execAsyncRemote via SSH).

File: packages/server/src/utils/schedules/utils.ts Lines: 76–87 (remote path in runSchedule) CWE: CWE-78 | CVSS: 8.0 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

schedule.command (DB-stored text(), no character restriction) is embedded in a shell string using single-quotes:

This is a container escape: the single-quote breakout happens at the HOST shell level before docker exec runs. A ' in command causes arbitrary code to run on the HOST, not inside the target container.

Attack payload: command = "'; touch /tmp/host-escape; echo '" → docker exec ABC bash -c ''; touch /tmp/host-escape; echo '' → touch /tmp/host-escape runs on HOST.