CVE-2026-45408

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.2

Description An issue exists where the app name validation regex permits shell metacharacters. An authenticated user can exploit this by pushing to a git remote using a crafted app name. This name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc in the fn-git-create-hook() function located at plugins/git/internal-functions:378. Consequently, bash interprets characters such as semicolons as command separators, allowing the execution of arbitrary commands as the dokku user.

Recommendations Update Dokku to version 0.38.2.