Docker disclosed and patched a critical vulnerability, CVE-2026-77179, affecting Docker Sandboxes versions 0.28.0 through 0.41.x on macOS. The flaw sits in the virtio-fs host server that Docker Sandboxes uses to share files between a virtual machine and the host: when the server reopens an unlinked file from a previously stored path, it improperly follows symbolic links. A malicious guest can exploit that behavior by replacing a parent directory with a symlink, breaking out of the shared workspace it was supposed to be confined to.
Once outside the shared workspace, code running inside the sandboxed VM can read or modify arbitrary files anywhere on the host, running with the privileges of the host account that operates the virtual machine, which can extend to host code execution. Docker fixed the issue in version 0.42.0, released September 7, 2026. Docker has not reported any in-the-wild exploitation, and as of the September 16 edition of CISA’s Known Exploited Vulnerabilities catalog, the flaw had not been added.
Why it matters
Sandboxing is supposed to be the containment boundary that makes it safe to run untrusted or AI-agent-generated code; a host-escape flaw in the sandbox’s own file-sharing layer undermines that boundary for any developer or CI pipeline that assumed the VM could not touch files outside its assigned workspace.
Leave a Reply