Dokku versions older than 0.38.25 permit a user with app‑level Dokku access and SSH connectivity to store arbitrary strings via the docker‑options plugin. These strings are later concatenated into the DOCKER_ARGS environment variable and evaluated by Bash during build, deploy, or run operations. Because Bash interprets shell command substitutions in DOCKER_ARGS, an attacker can inject commands that run on the host with the privileges of the dokku operating‑system user, enabling arbitrary host‑side command execution.

This vulnerability impacts the Dokku platform as a service on any deployment running a Dokku version earlier than 0.38.25. It applies to all users who have application‑level Dokku permissions and remote SSH access to the host, as they can exploit the docker‑options feature to inject payloads.

The CVSS base score of 9 indicates a very high severity. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is < 1%, indicating a very low exploitation probability. The likely attack vector requires the attacker to already possess SSH access to the Dokku host and to use the docker‑options plugin, meaning untrusted users with elevated Dokku permissions can potentially trigger host‑side command execution. Given the high CVSS and the use of Bash eval, the risk remains significant in environments that allow unauthenticated or low‑privilege users to influence docker‑options values.