OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS…

A critical OS command injection vulnerability exists in OpenWrt's luci-app-dockerman package, specifically in LuCI master and openwrt-25.12 snapshots that include the ucode docker_rpc.uc RPC backend. The vulnerability stems from the run_ttyd handler building shell commands from user-controlled fields (id, cmd, uid) without proper sanitization or quoting, passing them directly to system() in the rpcd root context. The package's read ACL inadvertently exposes the docker.container.ttyd_start mutating method via broad ubus access grants. An authenticated attacker with only the luci-app-dockerman read ACL can inject shell metacharacters to achieve arbitrary command execution as root via HTTP POST to /ubus. Older versions openwrt-24.10 and openwrt-23.05 are not affected as they lack this backend. No patched version was available at the time of the advisory, though GitHub commits have been referenced as potential fixes.