Command Injection Vulnerability in Dokku Cron Plugin

CVE-2026-54636

What is CVE-2026-54636?

The Dokku PaaS framework, specifically prior to version 0.38.7, contains a vulnerability in its cron plugin. The plugin processes commands from the app.json configuration file, which can inadvertently allow an attacker to execute arbitrary commands on the host system. By utilizing special shell characters such as '>' or ';' within the cron command definitions in app.json, an attacker could break out of the Docker container environment, executing commands with the privileges of the Dokku user. This poses a significant security risk as it could result in unauthorized access to the underlying host. The issue has been remediated in version 0.38.7.

References