https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T13:47:50.276142+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-350813 EUVD-2026-350813 2026-10-09T13:47:50.278138+00:00 EUVD-2026-350813 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72740 fkie_cve-2026-72740 2026-10-09T13:47:50.278173+00:00

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.