EUVD-2026-31493
GHSA-cgqp-ww2v-6rjh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered.
Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
AnalysisAI
Arbitrary code execution in Docker Desktop's vllm-metal inference backend on macOS allows any container on the Docker network to trigger host-level RCE by pulling a malicious model from an OCI registry and requesting inference. The Docker Model Runner unconditionally sets trust_remote_code=True and runs without sandboxing, so AutoTokenizer.from_pretrained() loads attacker-controlled Python from the model and executes it as the Docker Desktop user. No public exploit identified at time of analysis; EPSS sits at 0.01% and SSVC marks exploitation as 'none' despite total technical impact.
Technical ContextAI
The flaw lives in Docker Model Runner's vllm-metal backend, the Apple Silicon GPU path for local LLM inference exposed via the model-runner.docker.internal endpoint. When a tokenizer is loaded, the code calls HuggingFace transformers' AutoTokenizer.from_pretrained() with trust_remote_code=True, an opt-in flag that instructs transformers to import arbitrary Python modules shipped alongside a model (custom tokenizer/configuration_*.py files). Because the runner additionally executes without a sandbox, this realizes CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): the host process loads untrusted code from an OCI-distributed model artifact and runs it with the privileges of the Docker Desktop user. CPE coverage (cpe:2.3:a:docker:docker_desktop) and the EUVD constraint Docker Desktop 4.62.0 to <4.68.0 confirm the issue is specific to the macOS Docker Desktop builds that bundle the Model Runner feature.
RemediationAI
Vendor-released patch: Docker Desktop 4.68.0 - upgrade macOS hosts from any 4.62.0-4.67.x build to 4.68.0 or later as documented at https://docs.docker.com/desktop/release-notes/#4680. As an interim workaround on unpatched hosts, disable Docker Model Runner in Docker Desktop settings (Features in development → Model Runner) which removes the vulnerable model-runner.docker.internal endpoint entirely at the cost of losing local LLM inference; alternatively, avoid running untrusted container images and restrict outbound model pulls to a trusted internal OCI registry mirror, which narrows the threat surface but does not eliminate it because any container with network access can still call the runner API. Do not rely on macOS user-level controls - exploitation runs as the Docker Desktop user, which is the developer's own account.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Share
External POC / Exploit Code
Leaving vuln.today