# CVE-2026-45408: Dokku OS command injection via app name in git pre-receive hook Source: https://junglewise.ai/threats/cve-2026-45408-dokku-os-command-injection-via-app-name-in-git-pre-receive-hook Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-26. Updated: 2026-06-26 License: CC BY 4.0 with a link back CVE-2026-45408 · Severity: critical · CVSS 9 · Published 2026-06-26 Dokku is an open-source Platform-as-a-Service (PaaS) that helps developers deploy and manage applications using Docker. A security flaw in how Dokku handles application names allows an authorized user to execute malicious commands on the underlying server. By using a specially crafted application name during a code deployment, an attacker could gain unauthorized access to the system, potentially leading to data theft or a complete service outage. Technologies: [Dokku](https://junglewise.ai/threats/technologies/dokku). Vendors: [Dokku](https://junglewise.ai/threats/vendors/dokku). ## Quick answers **Is CVE-2026-45408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45408 being exploited in the wild. **How severe is CVE-2026-45408?** Critical severity, with a CVSS score of 9, published 26 June 2026. **Which products and versions are affected?** Dokku < 0.38.2. **Is there a fix for CVE-2026-45408?** A patch was published on 2026-05-10: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-45408 attacked?** It is attacked over the network, in a network appliance. **Am I affected by CVE-2026-45408?** Check whether you run Dokku at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details An OS command injection vulnerability exists in Dokku's git plugin due to insufficient validation of application names and insecure shell scripting practices. The validation regex `(^[a-z0-9][^/:_A-Z]*$)` fails to filter shell metacharacters such as semicolons, backticks, and pipes. When a user pushes to a git remote, the `fn-git-create-hook()` function in `plugins/git/internal-functions` embeds the unquoted application name into a bash pre-receive hook using an unquoted heredoc (`<