Arcane, a Docker management tool, contains a command injection flaw in its updater service. The vulnerability allows a malicious command to be injected via lifecycle labels that are executed with /bin/sh -c without sanitization. This flaw can lead to execution of arbitrary code inside the container during an update operation.

GetArcaneApp Arcane version 1.12.x and earlier are affected. The issue was resolved in version 1.13.0.

The CVSS score is 9.1, indicating critical severity. The EPSS score is below 1%, suggesting low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated API user to create a project with the malicious lifecycle label; an administrator then triggers the container update, at which point the injected command executes inside the target container. The attack vector is therefore an authenticated, privileged operation, but the impact is full remote code execution within the container environment.