{
  "id": "CVE-2026-129433",
  "url": "https://spydr.io/cve/CVE-2026-129433",
  "published": "2026-11-14T13:17:22.820Z",
  "modified": "2026-11-14T13:17:22.940Z",
  "score": 9.4,
  "severity": "critical",
  "cvss_version": "4.0",
  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "score_source": "vulncheck.com",
  "epss": null,
  "epss_percentile": null,
  "exploited": false,
  "kev": null,
  "ssvc_exploitation": null,
  "vendors": [
    "Dokploy"
  ],
  "products": [
    "dokploy"
  ],
  "cwes": [
    "CWE-78"
  ],
  "description": "Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.",
  "status": "Deferred",
  "score_type": "Secondary",
  "scores": {
    "cvss_v40": 9.4,
    "cvss_v31": 9.9,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "https://github.com/Dokploy/dokploy",
      "tags": []
    },
    {
      "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/utils/backups/utils.ts#L152",
      "tags": []
    },
    {
      "url": "https://github.com/Dokploy/dokploy/commit/b24006e16e95a10ce3daf739d06ac783e5c70ba0",
      "tags": []
    },
    {
      "url": "https://github.com/Dokploy/dokploy/pull/5908",
      "tags": []
    },
    {
      "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1",
      "tags": []
    },
    {
      "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-j329-jw7j-rxjm",
      "tags": []
    },
    {
      "url": "https://www.vulncheck.com/advisories/dokploy-before-0.31.1-os-command-injection-via-compose-backup-servicename",
      "tags": []
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129433",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}