The vulnerability is an OS command injection that occurs when the customGitUrl provided by a user is parsed without proper shell quoting. The value of the domain component is inserted into an ssh-keyscan command that runs on the host during deployment. An authenticated member who has permission to deploy services and whose SSH key is attached to the account can supply a crafted customGitUrl that contains shell metacharacters. On executing the deployment, the injected command runs with the privileges of the Dokploy host process, giving the attacker arbitrary code execution on the machine.

This flaw affects the Dokploy PaaS platform, specifically all releases prior to v0.29.13 of the Dokploy server. The affected component is the utilities that handle SSH-based git providers.

The CVSS score of 9.9 marks this flaw as critical and indicates a high likelihood of severe impact if exploited. The EPSS score is not available, so no public exploitation probability data exist, but the high severity suggests that an attacker with deployment rights could act. KEV does not list this vulnerability, meaning no known active exploitation in the wild as of the data. Based on the description, it is inferred that the likely attack vector is through the normal deployment workflow, where an authenticated user with service deployment permission can supply a malicious customGitUrl. The exploitation requires level of access that is typically granted to trusted developers, so internal threat actors pose the most immediate risk.