Dokku · Dokku · CVE-2026-54636
**Name of the Vulnerable Software and Affected Versions**
Dokku versions prior to 0.38.7
**Description**
The cron plugin uses commands defined in the `app.json` file to manage system cron tasks running as the Dokku user. If a cron command in `app.json` contains special shell characters, such as `>` or `;`, it can lead to a container breakout, allowing the execution of arbitrary commands on the host system with the privileges of the Dokku user.
**Recommendations**
Update to version 0.38.7.