https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:22:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330739 EUVD-2026-330739 https://cve.radiocsirt.org/vuln/euvd-2026-330739 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45408 <p>Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (&lt;&lt;EOF instead of &lt;&lt;&#39;EOF&#39;) in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.</p> <p>Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (&lt;&lt;EOF instead of &lt;&lt;&#39;EOF&#39;) in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45408