EUVD-2026-31493
GHSA-cgqp-ww2v-6rjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRun malicious or compromised container on macOS host
-
DeliveryReach model-runner.docker.internal over Docker network
-
ExploitRequest pull of attacker-controlled OCI model
-
InstallTrigger inference to load tokenizer
-
C2AutoTokenizer imports embedded Python with trust_remote_code=True
-
ExecuteExecute arbitrary code as Docker Desktop user
-
ImpactSteal developer credentials and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | Requires (1) Docker Desktop for macOS at a version between 4.62.0 and 4.67.x with the Docker Model Runner feature enabled and the vllm-metal backend available (Apple Silicon path), and (2) the attacker controlling a process inside any container attached to the Docker network on that host, so it can reach the model-runner.docker.internal API to request a pull of an attacker-controlled OCI model and trigger an inference call. Limiting factors: this is macOS-only Docker Desktop (not Linux Docker Engine, not Windows), Model Runner must be enabled (it is an opt-in feature), and the attacker must already have code execution inside a container on the host - but no authentication to the runner API is needed beyond container network membership, and no end-user interaction is required once the malicious container is running. |
| Impact | Signals diverge sharply. CVSS 4.0 is 8.8 with high confidentiality, integrity, availability impact on both the vulnerable component and subsequent system (full host compromise), driven by AV:L/AC:L/PR:L/UI:N - local attack vector but no user interaction. Against that, EPSS is 0.01% (3rd percentile), SSVC reports Exploitation=none and Automatable=no, the CVE is not in CISA KEV, and the issue was self-reported by Docker. Practically meaningful nuance: 'AV:L' here is misleading for defenders - the description makes clear that any container sharing the Docker network can reach model-runner.docker.internal, so on a developer workstation running untrusted images this is effectively reachable by every container the user runs. Priority should be high for engineering laptops that pull third-party container images and have Model Runner enabled, and low for environments without Docker Desktop on macOS or with Model Runner disabled. |
| Exploit ScenarioDerived | A developer runs a third-party container image (e.g. from a public registry) on a macOS workstation with Docker Desktop 4.65 and Model Runner enabled. The container reaches model-runner.docker.internal, instructs the runner to pull an attacker-controlled OCI model containing a malicious tokenizer Python file, then issues an inference request; AutoTokenizer.from_pretrained() imports the attached Python and executes shellcode as the developer's Docker Desktop user, exfiltrating SSH keys and cloud credentials. No public exploit identified at time of analysis, but the primitive (trust_remote_code abuse) is well-documented in the HuggingFace ecosystem. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Arbitrary code execution in Docker Desktop's vllm-metal inference backend on macOS allows any container on the Docker network to trigger host-level RCE by pulling a malicious model from an OCI registry and requesting inference. The Docker Model Runner unconditionally sets trust_remote_code=True and runs without sandboxing, so AutoTokenizer.from_pretrained() loads attacker-controlled Python from the model and executes it as the Docker Desktop user. No public exploit identified at time of analysis; EPSS sits at 0.01% and SSVC marks exploitation as 'none' despite total technical impact.
Earlier versions of this analysis (2)
Arbitrary code execution in Docker Desktop's Model Runner (vllm-metal backend) on macOS allows any container on the Docker network to execute Python code on the host as the Docker Desktop user. The flaw stems from the inference backend hardcoding trust_remote_code=True when loading tokenizers from OCI-registry-hosted models, with no sandboxing around the resulting transformers.AutoTokenizer.from_pretrained() call. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis, but SSVC rates the technical impact as total.
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Docker network to execute Python code on the host as the Docker Desktop user. The vllm-metal backend hardcodes trust_remote_code=True when loading tokenizers and runs unsandboxed, so any model pulled from an OCI registry can ship attacker-controlled Python that executes when inference is requested via the model-runner.docker.internal API. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Docker Desktop 4.68.0 - upgrade macOS hosts from any 4.62.0-4.67.x build to 4.68.0 or later as documented at https://docs.docker.com/desktop/release-notes/#4680. As an interim workaround on unpatched hosts, disable Docker Model Runner in Docker Desktop settings (Features in development → Model Runner) which removes the vulnerable model-runner.docker.internal endpoint entirely at the cost of losing local LLM inference; alternatively, avoid running untrusted container images and restrict outbound model pulls to a trusted internal OCI registry mirror, which narrows the threat surface but does not eliminate it because any container with network access can still call the runner API. Do not rely on macOS user-level controls - exploitation runs as the Docker Desktop user, which is the developer's own account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Docker Model Runner's vllm-metal backend, the Apple Silicon GPU path for local LLM inference exposed via the model-runner.docker.internal endpoint. When a tokenizer is loaded, the code calls HuggingFace transformers' AutoTokenizer.from_pretrained() with trust_remote_code=True, an opt-in flag that instructs transformers to import arbitrary Python modules shipped alongside a model (custom tokenizer/configuration_*.py files). Because the runner additionally executes without a sandbox, this realizes CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): the host process loads untrusted code from an OCI-distributed model artifact and runs it with the privileges of the Docker Desktop user. CPE coverage (cpe:2.3:a:docker:docker_desktop) and the EUVD constraint Docker Desktop 4.62.0 to <4.68.0 confirm the issue is specific to the macOS Docker Desktop builds that bundle the Model Runner feature.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (Docker) · only source for this CVE.
CVSS VectorVendor: Docker
Lifecycle Timeline
4DescriptionCVE.org
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered.
Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
Executive ViewAI
Docker Desktop's vllm-metal backend on macOS contains a vulnerability that allows container workloads to gain direct control of the host system. Organizations using this feature for machine learning inference face immediate risks including loss of system control, data exposure, and operational disruption. Vendor patch deployment should be prioritized within 7 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB