{"id":"CVE-2022-39206","summary":"CI/CD Docker Escape in OneDev","details":"Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.","aliases":["GHSA-gjq9-4xx9-cr3q"],"modified":"2026-08-12T13:33:10.325604Z","published":"2022-09-13T18:50:14Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-610"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39206.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39206.json"},{"type":"ADVISORY","url":"https://github.com/theonedev/onedev/security/advisories/GHSA-gjq9-4xx9-cr3q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39206"},{"type":"FIX","url":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22"},{"type":"ARTICLE","url":"https://blog.sonarsource.com/onedev-remote-code-execution/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theonedev/onedev","events":[{"introduced":"0"},{"fixed":"83b09b15f7f4c1fdde22d0f7d0e13d2f561c731f"},{"fixed":"0052047a5b5095ac6a6b4a73a522d0272fec3a22"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"7.3.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*"}}],"versions":["v7.2.9","v7.2.8","v7.2.7","v7.2.5","v7.2.4","v7.2.3","v7.2.2","v7.2.1","v7.2.0","v7.1.8","v7.1.7","v7.1.6","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.3","v7.0.2","v7.0.1","v7.0.0","v6.3.13","v6.3.12","v6.3.11","v6.3.10","v6.3.9","v6.3.8","v6.3.7","v6.3.6","v6.3.5","v6.3.4","v6.3.3","v6.3.2","v6.3.1","v6.3.0","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1.0","v6.0.0","v5.4.0","v5.3.3","v5.3.1","v5.3.0","v5.2.2","v5.2.1","v5.2.0","v5.1.0","v5.0.1","v5.0.0","v4.11.0","v4.10.3","v4.9.2","v4.9.1","v4.9.0","v4.8.1","v4.8.0","v4.7.0","v4.6.1","v4.6.0","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.2","v4.3.0","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.6","v4.1.5","v4.1.4","v4.1.3","v4.1.2","v4.1.0","v4.0.9","v4.0.8","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.2","v3.1.1","v3.1.0","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","2.0.5","2.0.4","2.0.0","2.0-beta-build120","2.0-beta-build119"],"database_specific":{"vanir_signatures_modified":"2026-08-12T13:33:10Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["171553209971458749302510786475997148811","108764402595577419565919088464804779036","276891942501863069798316852247631395414","203057969819421749853168299686061452830","179198251250952916564195317672469547857","1689230836647862161616009829188003027","27222080634566875386795168409436366690","266415137804732473334421726943680739757","213860427339475525175083340443900808","62969780637124904399894429925610869964","300932100084462911546136694444476819061"],"threshold":0.9},"id":"CVE-2022-39206-3ec4a910","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-plugin/server-plugin-executor-remotedocker/src/main/java/io/onedev/server/plugin/executor/remotedocker/RemoteDockerExecutor.java"}},{"digest":{"line_hashes":["246258937094786476293019171475381908071","69789055163735808059418866180315868430","160734752521834068992517749119829653901","240162390068422462509600181405629420492","42255272644831292235943510680255064942","285815220812149641500548950735997971951","159509950056000471186033957556649869370","57494383796080766417387504146630479889","197569718970475878088374598589125543503","336244567403065053482958750159554153255","49381940099749133031441371108322291950","274551905626540673235352096535252620695","183333301115075714466519880474074189035"],"threshold":0.9},"id":"CVE-2022-39206-4fd85afb","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-plugin/server-plugin-executor-serverdocker/src/main/java/io/onedev/server/plugin/executor/serverdocker/ServerDockerExecutor.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"329970975310707046308641295182023432329","length":1069},"id":"CVE-2022-39206-568782fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-plugin/server-plugin-executor-remotedocker/src/main/java/io/onedev/server/plugin/executor/remotedocker/RemoteDockerExecutor.java","function":"runOn"}},{"deprecated":false,"digest":{"function_hash":"173804924828849408505773037534433237224","length":1550},"id":"CVE-2022-39206-691dadeb","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"function":"execute","file":"server-plugin/server-plugin-executor-remotedocker/src/main/java/io/onedev/server/plugin/executor/remotedocker/RemoteDockerExecutor.java"}},{"signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-plugin/server-plugin-executor-serverdocker/src/main/java/io/onedev/server/plugin/executor/serverdocker/ServerDockerExecutor.java","function":"execute"},"deprecated":false,"digest":{"function_hash":"108126904115406442266071098328534665088","length":10424},"id":"CVE-2022-39206-79e7ee91","signature_type":"Function"},{"target":{"function":"run","file":"server-plugin/server-plugin-executor-serverdocker/src/main/java/io/onedev/server/plugin/executor/serverdocker/ServerDockerExecutor.java"},"deprecated":false,"digest":{"function_hash":"269141754060779322696892577887021835039","length":9513},"id":"CVE-2022-39206-99f233c3","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22"},{"target":{"file":"server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesExecutor.java","function":"execute"},"deprecated":false,"digest":{"function_hash":"180403944156952156232214629697292553562","length":13013},"id":"CVE-2022-39206-a36b81c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22"},{"deprecated":false,"digest":{"line_hashes":["198002087943386797168254842463905284212"],"threshold":0.9},"id":"CVE-2022-39206-c19dc063","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-core/src/main/java/io/onedev/server/migration/DataMigrator.java"}},{"target":{"file":"server-plugin/server-plugin-executor-serverdocker/src/main/java/io/onedev/server/plugin/executor/serverdocker/ServerDockerExecutor.java","function":"runStepContainer"},"deprecated":false,"digest":{"function_hash":"154364104076446073851120963407829530685","length":2463},"id":"CVE-2022-39206-c4618583","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22"},{"deprecated":false,"digest":{"line_hashes":["73561981763327665338521830924043130622","243082030194595320381449754951553863062","198416743372691170303199075818374453366","302158960056844417309412417522771727013","33521723210406332395087601222451975333","117394905104576927262583588839332229873","329661096245958881216997322595099573422","98837304476880691773428218075478161859","234299398238454057429874519959320456928","45426809768214129351540581743312359960","77233294695494113955683827068101293290","326646572052354575912927761592344847788","329817847744888308144394032834200868350","43042802563630386153694985736790959608","288252472852980792442642909951038880896","125084055540645490701547745864515580198","247152133380157492748194107427736702677","177490458846242598731834729062779304439","124121173325242680589397542607966333821","24620894229037223679142883270690835704","86868828177912245128063853024109442533","322975514781739211343912291099903532392","50718666559232756617391087200914844780"],"threshold":0.9},"id":"CVE-2022-39206-e60a3c44","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22","target":{"file":"server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesExecutor.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39206.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}