CVE-2026-54636CWE-78

Dokku: OS Command Injection via app.json managed Cron

Critical · published June 26, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-26T16:23Z
EPSS history
Timeline
  • 26 JUN 16:23Z
    Dokku: OS Command Injection via app.json managed Cron
    cvelistv5