Command Injection Vulnerability in Arcane Docker Management Tool

CVE-2026-23520

What is CVE-2026-23520?

The Arcane Docker Management Tool contains a command injection vulnerability in its updater service prior to version 1.13.0. This flaw arises from the mismanaged handling of lifecycle labels, specifically 'com.getarcaneapp.arcane.lifecycle.pre-update' and 'com.getarcaneapp.arcane.lifecycle.post-update', where user-defined values are executed as shell commands without prior sanitization. Authenticated users can exploit this vulnerability by creating projects that specify malicious commands within these labels. When an administrator performs a container update, the malicious command gets executed in the container's context, thereby compromising the security of the application.

References