Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
coollabsio · coolifyReferences
https://github.com/coollabsio/coolifyhttps://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy.phphttps://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns.phphttps://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249995dahttps://github.com/coollabsio/coolify/releases/tag/v4.2.0https://www.vulncheck.com/advisories/coolify-before-4.2.0-remote-code-execution-via-environment-variable-key