CVE-2025-64419 Coolify vulnerable to command injection via docker-compose.yaml parameters

Critical 9.7 Published 5 Jan 2026 Updated 5 Jan 2026

Attackers can execute arbitrary commands as root on Coolify instances by crafting malicious docker-compose parameters in a repository.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-64419?

CVE-2025-64419 is a critical command injection vulnerability in coollabsio coolify, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

Weakness: CWE-77

Which versions are affected by CVE-2025-64419?

It affects 1 product.

Products include Coollabs Coolify.

How do I fix CVE-2025-64419?

No fix has been published for CVE-2025-64419 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-64419 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64419 exists.

Sources

Also known as GHSA-234r-xrrg-m8f3.