CVE-2026-54636 Details

A command injection vulnerability has been identified in the Dokku cron plugin, prior to version 0.38.7. The issue arises because the cron plugin executes commands from the app.json file for system cron management under the Dokku user. If an app.json cron command includes special shell characters, such as '>' or ';', it can escape the Docker container's confines and execute commands on the host system as the Dokku user. This vulnerability affects installations using the app.json plugin with cron integration, particularly those where openresty is the configured proxy.

Users can upgrade to Dokku version 0.38.7 or later to address this vulnerability.