CVE-2026-34597

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.470

Description An authenticated host remote code execution issue exists due to improper handling of user-defined build parameters within the Nixpacks build pack. The install command variable is directly concatenated into a shell command string executed on the deployment host during the building phase, allowing an attacker to escape the build context and execute arbitrary commands with host-level privileges.

Recommendations Update to version 4.0.0-beta.470.