Critical
Dokku: OS Command Injection via app.json managed Cron
Type: advisorySources: OSV
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-54636
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:20 UTC · Revision 1
Source evidence
Dokku: OS Command Injection via app.json managed Cron
core-osv · Original sourcePublished 26 Jun 2026, 16:23 UTC
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
osv:CVE-2026-54636
Complete source record
{
"id": "26165fb31a7c13286589723b8744983f25ea92f9e878feaf58fd9d958fed90f5",
"url": "https://osv.dev/vulnerability/CVE-2026-54636",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Dokku: OS Command Injection via app.json managed Cron",
"summary": "Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.",
"evidence": "osv:CVE-2026-54636",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-54636",
"aliases": [
"CVE-2026-54636",
"GHSA-72vm-7pc2-x95w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dokku/dokku",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fd9e06d56bd5ee6f38a4ab456f6795568290863e"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.38.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:dokku:dokku:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.38.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v0.38.6",
"v0.38.5",
"v0.38.4",
"v0.38.3",
"v0.38.2",
"v0.38.1",
"v0.38.0",
"v0.37.10",
"v0.37.9",
"v0.37.8",
"v0.37.7",
"v0.37.6",
"v0.37.5",
"v0.37.4",
"v0.37.3",
"v0.37.2",
"v0.37.1",
"v0.37.0",
"v0.36.11",
"v0.36.10",
"v0.36.9",
"v0.36.8",
"v0.36.7",
"v0.36.6",
"v0.36.5",
"v0.36.4",
"v0.36.3",
"v0.36.2",
"v0.36.1",
"v0.36.0",
"v0.35.20",
"v0.35.19",
"v0.35.18",
"v0.35.17",
"v0.35.16",
"v0.35.15",
"v0.35.14",
"v0.35.13",
"v0.35.12",
"v0.35.11",
"v0.35.10",
"v0.35.9",
"v0.35.8",
"v0.35.7",
"v0.35.6",
"v0.35.5",
"v0.35.4",
"v0.35.3",
"v0.35.2",
"v0.35.1",
"v0.35.0",
"v0.34.9",
"v0.34.8",
"v0.34.7",
"v0.34.6",
"v0.34.5",
"v0.34.4",
"v0.34.3",
"v0.34.2",
"v0.34.1",
"v0.34.0",
"v0.33.9",
"v0.33.8",
"v0.33.7",
"v0.33.6",
"v0.33.5",
"v0.33.4",
"v0.33.3",
"v0.33.2",
"v0.33.1",
"v0.33.0",
"v0.32.4",
"v0.32.3",
"v0.32.2",
"v0.32.1",
"v0.32.0",
"v0.31.5",
"v0.31.4",
"v0.31.3",
"v0.31.2",
"v0.31.1",
"v0.31.0",
"v0.30.11",
"v0.30.10",
"v0.30.9",
"v0.30.8",
"v0.30.7",
"v0.30.6",
"v0.30.5",
"v0.30.4",
"v0.30.3",
"v0.30.2",
"v0.30.1",
"v0.30.0",
"v0.29.4",
"v0.29.3",
"v0.29.2",
"v0.29.1",
"v0.29.0",
"v0.28.4",
"v0.28.3",
"v0.28.2",
"v0.28.1",
"v0.28.0",
"v0.27.9",
"v0.27.8",
"v0.27.7",
"v0.27.6",
"v0.27.5",
"v0.27.4",
"v0.27.3",
"v0.27.2",
"v0.27.1",
"v0.27.0",
"v0.26.8",
"v0.26.7",
"v0.26.6",
"v0.26.5",
"v0.26.4",
"v0.26.3",
"v0.26.2",
"v0.26.1",
"v0.26.0",
"v0.25.7",
"v0.25.6",
"v0.25.5",
"v0.25.4",
"v0.25.3",
"v0.25.2",
"v0.25.1",
"v0.25.0",
"v0.24.10",
"v0.24.9",
"v0.24.8",
"v0.24.7",
"v0.24.6",
"v0.24.5",
"v0.24.4",
"v0.24.3",
"v0.24.2",
"v0.24.1",
"v0.24.0",
"v0.23.9",
"v0.23.8",
"v0.23.7",
"v0.23.6",
"v0.23.5",
"v0.23.4",
"v0.23.3",
"v0.23.2",
"v0.23.1",
"v0.23.0",
"v0.22.6",
"v0.22.9",
"v0.22.8",
"v0.22.7",
"v0.22.5",
"v0.22.4",
"v0.22.3",
"v0.22.2",
"v0.22.1",
"v0.22.0",
"v0.21.4",
"v0.21.3",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.4",
"v0.20.3",
"v0.20.2",
"v0.20.1",
"v0.20.0",
"v0.19.13",
"v0.19.12",
"v0.19.11",
"v0.19.10",
"v0.19.9",
"v0.19.8",
"v0.19.7",
"v0.19.6",
"v0.19.5",
"v0.19.4",
"v0.19.3",
"v0.19.2",
"v0.19.1",
"v0.19.0",
"v0.18.5",
"v0.18.4",
"v0.18.3",
"v0.18.2",
"v0.18.1",
"v0.18.0",
"v0.17.9",
"v0.17.8",
"v0.17.7",
"v0.17.6",
"v0.17.5",
"v0.17.4",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.4",
"v0.16.3",
"v0.16.2",
"v0.16.1",
"v0.16.0",
"v0.15.5",
"v0.15.4",
"v0.15.3",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.6",
"v0.14.5",
"v0.14.4",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.4",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.13",
"v0.12.12",
"v0.12.11",
"v0.12.10",
"v0.12.9",
"v0.12.8",
"v0.12.7",
"v0.12.6",
"v0.12.5",
"v0.12.4",
"v0.12.3",
"v0.12.2",
"v0.12.1",
"v0.12.0",
"v0.11.6",
"v0.11.5",
"v0.11.4",
"v0.11.3",
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.10.5",
"v0.10.4",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.0",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.5",
"v0.6.4",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.8",
"v0.5.7",
"v0.5.6",
"v0.5.5",
"v0.5.4",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.14",
"v0.4.13",
"v0.4.12",
"v0.4.11",
"v0.4.10",
"v0.4.9",
"v0.4.8",
"v0.4.7",
"v0.4.6",
"v0.4.5",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.26",
"v0.3.25",
"v0.3.24",
"v0.3.23",
"v0.3.22",
"v0.3.21",
"v0.3.20",
"v0.3.19",
"v0.3.18",
"v0.3.17",
"v0.3.16",
"v0.3.15",
"v0.3.14",
"v0.3.13",
"0.3.13",
"v0.3.12",
"v0.3.11",
"v0.3.10",
"v0.3.9",
"v0.3.8",
"v0.3.7",
"v0.3.6",
"v0.3.5",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.3.1",
"v0.3.0",
"v0.2.3",
"dev",
"v0.2.0-RC1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54636.json"
}
}
],
"modified": "2026-10-28T02:30:46.226151403Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54636.json",
"https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w",
"https://nvd.nist.gov/vuln/detail/CVE-2026-54636",
"https://github.com/dokku/dokku/pull/8672"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54636.json"
}
},
"related_cves": [
{
"value": "CVE-2026-54636",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514227,
"published_at": "2026-06-26T16:23:58.377+00:00"
}