PT-2026-56027 · Coolify · Coolify

Everping · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-42204

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions 4.0.0-beta.471 through 4.0.0-beta.473

Description A regression in the SHELL SAFE COMMAND PATTERN allows ampersands to be used in custom Docker Compose build, start, and pre/post-deployment command fields. This enables an authenticated team member to perform shell command injection, resulting in the execution of arbitrary commands on the host system.

Recommendations Update to version 4.0.0-beta.474.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42204

Affected Products

Coolify

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-42204 · Security Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 · Note
• https://github.com/coollabsio/coolify/commit/e1aac50b745cf499e710b7e35cd2a9d6a1538dd9 · Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-chg4-63hm-xv9x · Note
• https://github.com/coollabsio/coolify/pull/9684 · Note
• https://twitter.com/infoflowcloud/status/2074258620728881229 · Twitter Post
• https://twitter.com/CVEnew/status/2074257034036568180 · Twitter Post