Description
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker.io | 18.09.1+dfsg1-8 | — |
| Debian 13 | docker.io | 18.09.1+dfsg1-8 | — |
| Debian 12 | docker.io | 18.09.1+dfsg1-8 | — |
| Debian 10 | docker.io | 18.09.1+dfsg1-7.1+deb10u1 | DSA-4521-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Other 7 | docker +7 | 2:1.13.1-104.git4ef4b30.el7 | RHBA-2019:3092 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | docker-engine | 18.09.8.ol-1.0.4.el7 | ELSA-2019-4813 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
hakaii59/CVE-2019-13139 ★ 0 · Nov 10, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-4521-1 docker.io - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHBA-2019:3092 Red Hat Bug Fix Advisory: docker bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-4813 Important: docker-engine security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 3, 2019
References
- https://github.com/moby/moby/pull/38944
- https://docs.docker.com/engine/release-notes/#18094
- https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/
- DSA-4521 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190910-0001/
- 20190910 [SECURITY] [DSA 4521-1] docker.io security update mailing-list
- RHBA-2019:3092 vendor-advisory