The flaw exists in Coolify’s executeInDocker() helper, which wraps user-supplied commands in a bash -c string without escaping single quotes. This allows a single‑quote injection that escapes the intended argument and executes arbitrary shell commands on the host, outside the Docker container. The vulnerability can be immediately exploited to run any commands with the host’s privileges and was addressed by upgrading to version 4.0.0‑beta.464.

All installations of Coollabsio Coolify that are running a version before 4.0.0‑beta.464 and expose the docker_compose_custom_build_command or docker_compose_custom_start_command fields are vulnerable. Anyone with write access to these fields can trigger the injection. No other Coolify releases or components are affected.

The CVSS score of 6.6 indicates a moderate severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but it provides a clear attack path: an authenticated user who can modify the custom command fields can execute commands on the host. Because the impact is full remote command execution, the risk remains significant, especially for environments where untrusted users have write access to those fields.