The flaw in Coolify’s buildHelperImage method embeds the dev_helper_version string directly into a Docker build command without any shell escaping. This unchecked concatenation permits an attacker who can control that field and trigger a helper image build to inject arbitrary shell commands. As a result, the attacker can execute code on the host system, elevating the injection type to remote code execution, classified as CWE‑78.

Coolify deployments running a version prior to 4.0.0‑beta.474 are affected. Versions 4.0.0‑beta.474 or later contain the fix and are not susceptible to this issue.

The CVSS base score of 3.8 indicates a low overall severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must have the ability to set the dev_helper_version field and invoke a Docker build in a development environment, implying local or privileged access rather than a true remote exploit. Consequently, while the operational risk is considered low, users with such access can run arbitrary commands.