The vulnerability resides in Coolify's executeInDocker helper, which encloses user‑supplied commands in single quotes without escaping inner single quotes. An attacker able to edit application settings can insert a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command, breaking out of the quoted context and executing arbitrary shell commands on the host during deployment. This allows remote code execution on the managed server, bypassing the confinement normally provided by Docker containers.

Affected is the Coolify product from Coollabsio. Versions prior to 4.0.0-beta.469 are impacted; the vulnerability is fixed in 4.0.0-beta.469.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires the ability to edit application settings, implying authenticated or elevated privileges. Once that condition is satisfied, arbitrary commands can be run on the host system during deployment.