Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.

Coolify versions before 4.2.0 contain a critical vulnerability where environment variable key names are not properly escaped in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to achieve arbitrary command execution on the host server, outside of container boundaries. This represents a container escape scenario with significant impact on multi-tenant or managed hosting environments. The vulnerability was patched in version 4.2.0. Relevant policy and validation pattern files in the codebase were updated as part of the fix. A specific commit (b50839d) addresses the improper escaping. The issue has been documented by VulnCheck with a dedicated advisory.