CVE-2026-34158 is an OS command injection vulnerability (CWE-78) in coollabsio's Coolify product. The executeInDocker() helper wraps user-supplied commands in single quotes but fails to escape embedded single quotes properly. This flaw allows an attacker who can modify application settings to inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command, breaking out of the intended quoted context. Consequently, arbitrary commands can be executed on the host server outside the Docker container confinement during deployment processes. The issue is resolved in Coolify version 4.0.0-beta.469.

Successful exploitation allows an attacker with limited privileges (permission to edit application settings) to execute arbitrary commands on the underlying host system with the privileges of the deployment process. This can lead to full compromise of the host, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability.

Upgrade to Coolify version 4.0.0-beta.469 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is documented. Until upgrading, restrict access to application settings to trusted users only to prevent exploitation.