Servers and applications
GHSA-x3g8-6v8j-rm56
OS command injection via libsql appName missing APP_NAME_REGEX validation
- Severity
- Critical 9.1
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.0
- Weakness
- OS command injection (CWE-78)
- Attack
- Over the network · Needs an administrator account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H- Sources
- Project advisories (GitHub)
Description
The libsql database service is the only database type whose appName field is not validated by APP_NAME_REGEX. appName flows unquoted into docker service/docker ps shell commands executed via execAsync/execAsyncRemote, allowing OS command injection on the Dokploy host.
apiCreateLibsql types appName as z.string().min(1) (apps/dokploy/server/api/routers/libsql.ts:118) — every other database (postgres/mysql/mariadb/mongo/redis) applies .regex(APP_NAME_REGEX) (added to all DBs except libsql by commit 960892fd8). The value is passed through cleanAppName (schema/utils.ts:66 = .trim().replace(/ /g,"-").toLowerCase()), which does NOT strip $ ( ) ; | . It then reaches getServiceContainerCommand — docker ps ... --filter "...service.name=${appName}" (double-quoted → $(...) fires) — and unquoted docker service commands.
Command execution on the Dokploy control-plane host (Docker socket → app→host escape) or a managed remote server = RCE.
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-x3g8-6v8j-rm56
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-x3g8-6v8j-rm56