Dokploy PaaS 0.29.2 and earlier construct shell commands by interpolating unsanitized user input—branch names, repository URLs, and Docker credentials—directly into JavaScript template literals that are executed via child_process.exec. The lack of escaping in these shell calls allows an attacker to insert arbitrary shell commands, effectively hijacking the execution context of the server process. This represents an Input Validation Failure (CWE-20) and a Command Injection (CWE-77).

The vulnerability affects Dokploy, the free, self‑hosted Platform as a Service platform, for all releases up to and including 0.29.2. Users with application create or edit privileges in the application can trigger the flaw.

The CVSS score of 9.6 indicates a Critical severity, and the vulnerability is exploitable by any authenticated user who has permission to create or edit applications. Although the EPSS score is not available, the lack of a KEV listing does not mitigate the potential impact. Attackers can leverage the injection to execute arbitrary commands on the host, leading to full system compromise.