Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
CVE-2026-77179 (CVSS 9.4, macOS-only) is a symlink-following flaw in the virtio-fs host server of Docker Sandboxes versions 0.28.0 to 0.41.x that lets guest code escape the shared project directory and read or modify host files as the VMM user, potentially leading to host code execution. A second flaw, CVE-2026-79994 (CVSS 8.7), is a check-to-use race in the Unix socket relay that lets a sandbox connect to AF_UNIX sockets outside its workspace. Both were fixed in version 0.42.0 on September 7 and disclosed September 15; no exploitation has been reported and neither flaw is in CISA's KEV catalog.
- Guest replaces a directory with a symlink; virtio-fs follows it, enabling host file access as VMM user
- Second flaw CVE-2026-79994 (CVSS 8.7) exposes AF_UNIX sockets outside the sandbox workspace
- Fixed in Docker Sandboxes 0.42.0 (September 7); 0.43.0 is the current release; no exploitation seen
- Sandboxes isolate AI coding agents, and the escape runs with the host account's rights
- Mitigation: use clone mode and avoid read-write host mounts until updating
- Products
- Docker Sandboxesvirtio-fs
- Organizations
- Cyera Research Labsaccompl.aiThreatNotify
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-77179+1 related CVE | Symlink Escape in Docker Sandboxes virtio-fs Exposes macOS Host Files | 9.4 group max | <1% | PoC |
From the original article
4 min read at thehackernews.com
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.