CVE‑2026‑129433: Dokploy OS command injection now in NVD

A new CVE, CVE‑2026‑129433, has been added to the NVD for Dokploy versions before 0.31.1. The advisory notes an OS command‑injection flaw in `getComposeContainerCommand()` that lets authenticated organization members run arbitrary shell commands via the `serviceName` parameter. Attackers can store shell metacharacters in this field through backup.create or backup.update procedures, and the commands execute as root when scheduled backups run, giving control over the host through the mounted Docker socket. The NVD lists a CVSS score of 9.9 (CRITICAL). No vendor advisory or CISA KEV listing has yet been published, and the fixed version is 0.31.1. This flaw enables remote code execution on the host, making it a high priority for administrators. The NVD record is the sole source of this information at present. Dokploy users should upgrade immediately to 0.31.1 or later to eliminate the risk. View the NVD record