A flaw in Coolify causes pre‑and post‑deployment commands to be single‑quote escaped but delivered over an SSH heredoc that preserves newlines. This allows an attacker with an authenticated account to insert newline characters to terminate the intended command and inject additional shell statements. The vulnerability is a classic command injection flaw (CWE‑78) that results in arbitrary code execution on the remote deployment host, compromising confidentiality, integrity, and availability of the deployed application or services.

Coolify releases up to and including version 4.0.0-beta.470 are vulnerable. The issue was addressed in release 4.0.0-beta.471 and later.

The vulnerability carries a CVSS score of 8.8, classifying it as high severity. Its EPSS score of < 1% indicates a very low but nonzero probability of real‑world exploitation, and it is not listed in the CISA KEV catalog. The attack requires an authenticated user with permission to configure deployment commands; the vector is therefore internal or authenticated from within the application. Successful exploitation would allow the attacker to execute arbitrary commands on the remote deployment host.