Dokku is a Docker‑based Platform as a Service that deploys applications via git pushes. A flaw in the application name validation regex allows shell metacharacters to enter the name unquoted. On a push, Dokku writes the app name into a bash pre‑receive hook using a non‑quoted heredoc. Bash then interprets shell metacharacters such as a semicolon as command separators, enabling an attacker who can push to the repository to execute arbitrary commands as the dokku user. This is an operating‑system command injection (CWE‑78) that can compromise the confidentiality, integrity, and availability of the entire Dokku host.

Versions of Dokku older than 0.38.2 are affected. The issue resides in the dokku:dokku product and touches any instance that uses the default git pre‑receive hook. Any deployment that has not yet applied the 0.38.2 update remains vulnerable.

The vulnerability has a CVSS score of 9, classifying it as critical. Although no EPSS score is available and it is not listed in CISA KEV, the exploitation probability is uncertain; however the lack of a KEV listing does not preclude real-world attacks. The attack vector requires authenticated git push access, so it is limited to users who are allowed to deploy. The exploit path is straightforward: push a repository with an app name containing a shell metacharacter; the pre‑receive hook runs the embedded command, granting the attacker execution as dokku.