Duck Site before version 1.0.1 had a CI/CD workflow that executed a deployment job after a build job finished. The build job triggers on pull requests, while the deploy job ran with package‑write permissions and deployment secrets. An attacker could create a pull request that satisfies the deploy job’s main‑branch condition; the workflow would then check out the PR commit, build it into a Docker image, publish it as latest, and trigger a Dokploy deployment. This allows attacker code to be deployed to production without being merged, effectively executing arbitrary code on the production site.

The vulnerable product is Duck Site from duck‑organization. All releases prior to 1.0.1 are affected. Version 1.0.1 includes a patch that prevents the deploy workflow from running on unmerged pull requests. Users should upgrade to 1.0.1 or later to remediate the issue.

The vulnerability carries a CVSS score of 9.5, indicating a very high risk of remote exploitation. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack vector is remote, relying on the ability to submit a pull request that the CI system will accept and deploy. Because the exploit requires only the standard pull request submission workflow and leverages privileged deployment secrets, the gap represents a serious security risk until the fix is applied.