Docker Sandboxes flaw allows local code execution
Original title: ZDI-26-894: Docker Sandboxes Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
ZDI rates CVE-2026-121614 at CVSS 7.8; the user must open a malicious file or page.
ZDI published ZDI-26-894 for Docker Sandboxes, described as inclusion of functionality from an untrusted control sphere and tracked as CVE-2026-121614. Local attackers can execute arbitrary code on affected installations, but the target must visit a malicious page or open a malicious file. ZDI assigned CVSS 7.8. The snippet does not list versions, a fix, or exploitation status.
Unconfirmed: No affected versions, fix, or exploitation status is given in the snippet.
- ZDI advisory ID is ZDI-26-894.
- Attackers are described as local, not remote.
- CVSS rating assigned by ZDI is 7.8.
- User interaction is required to exploit the flaw.
Impact: Local arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Docker Sandboxes | — |
- CVEs
- CVE-2026-121614
- Vendors
- Docker
- Products
- Docker Sandboxes
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121614 | External command execution via Git config in Docker Sandboxes before 0.50.0 | 7.1 | — |
From the original article
This vulnerability allows local attackers to execute arbitrary code on affected installations of Docker Sandboxes. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.