Prevent command injection via docker options eval
fix: prevent command injection via docker options eval
Prevent command injection via docker options eval1a376c-fix-prevent-command-injection-via-docker-options-cve-2026-86002fixprevent command injection via docker options
Committed by josegonzalez
commit message
fix: prevent command injection via docker options eval
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.Editor assessment
This commit patches CVE-2026-86002. Excellent. The body states the attack path precisely: values from docker options, --ttl-seconds and -e flowed into a Bash eval during build, deploy and run, letting a low-privileged user execute commands as the dokku user. It then explains the fix - tokenize and pass arguments verbatim without shell expansion - and calls out the one-time label migration for stored backslashes. Concise, complete and easy to verify. Style-wise the message is clean and the body is a compact, well-separated explanation; no scope is needed for a subject this specific.