Docker Sandboxes CVE-2026-103916

Requires an attacker-controlled (malicious or compromised) Docker Sandbox that shares a workspace with the host and can create or replace a symlink within that workspace, plus a subsequent user-initiated sbx cp copy operation that follows the planted symlink. Exploitation is limited by: local attack vector (the attacker must already be executing inside a sandbox); mandatory victim interaction (the copy is user-initiated, UI:A); and the invoking user's own filesystem permissions, which bound which host files can be read or written. It does not apply to deployments that never run untrusted sandbox content or never perform host-side sbx cp copies. Updating to Docker Sandboxes v0.51.0 is the remediation indicated by the vendor release notes.

This is a genuine but conditional local vulnerability, not a remote mass-exploitation threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes local exploitation that is low-complexity and needs no host privileges, but requires active user interaction - the victim must initiate an sbx cp operation after a malicious sandbox has planted or swapped a workspace symlink (CWE-59). Impact is rated high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) because the flaw yields both arbitrary host-file reads into the sandbox and sandbox-controlled writes to arbitrary host paths with the invoking user's permissions, with no subsequent-system scope change (SC:N/SI:N/SA:N). The vuln.today decision label is 'this_week', which aligns with a serious-but-not-emergency priority. No CISA KEV listing and no EPSS score are provided in the input, and no public exploit reference is supplied, so exploitation is not confirmed. The main signals are therefore consistent: real integrity/confidentiality/availability impact on the host, gated behind local presence of a malicious sandbox plus a user-triggered copy, which points to targeted abuse of untrusted sandbox workloads rather than broad opportunistic exploitation.

A user runs untrusted or AI-agent-driven code inside a Docker Sandbox. That malicious sandbox creates or replaces a symlink inside the shared workspace pointing outside the workspace; when the user later runs sbx cp, the copy follows the symlink to read a sensitive host file into the sandbox or to overwrite a host file with sandbox-controlled data using the user's permissions. No public exploit identified at time of analysis.