EUVD-2026-31491
GHSA-9m9w-53g9-47c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain code execution in a container on Docker network
-
DeliveryPublish malicious model to attacker-controlled OCI registry
-
ExploitCall model-runner.docker.internal pull API
-
ExecutionMLX-LM importlib loads model_file Python
-
PersistInference request executes payload unsandboxed
-
ImpactRCE as Docker Desktop user on macOS host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | Requires Docker Desktop 4.56.0-4.70.x on macOS with Docker Model Runner enabled and the MLX inference backend in use (Apple Silicon). The attacker must be able to reach the model-runner.docker.internal API, which in practice means controlling or compromising a container on the Docker network (CVSS PR:L, AV:L, AT:P). The attacker must also control an OCI registry that the backend will pull from, and the malicious model's config.json must specify a model_file pointing to an attacker-supplied Python file. No user interaction on the host is required (UI:N). Limiting factors: macOS-only, MLX backend only, and the victim must trigger an inference against the attacker-supplied model - Windows/Linux Docker Desktop and non-MLX backends are out of scope. |
| Impact | Signals diverge meaningfully here. CVSS 4.0 is 8.8 with VC:H/VI:H/VA:H and full subsequent-system impact (SC:H/SI:H/SA:H), reflecting that breakout from a container to the host MLX process is total compromise of the Docker Desktop user account. However, AV:L plus AT:P plus PR:L means the attacker needs an existing foothold on the Docker network and the victim host must be running the MLX backend on macOS - meaningfully narrowing real-world reach. EPSS sits at 0.01% (3rd percentile) and SSVC reports Exploitation: none and Automatable: no, consistent with no public exploit identified at time of analysis. Net: a real and high-severity supply-chain-via-model risk for macOS developer workstations using Model Runner, but not a mass-exploitation candidate; prioritize for developer endpoints that pull models from untrusted sources, deprioritize where Model Runner is disabled or only consumes vetted registries. |
| Exploit ScenarioDerived | An attacker publishes a malicious model to a public OCI registry with a config.json whose model_file points to a Python payload bundled in the artifact. A developer running Docker Desktop on macOS executes an untrusted container - or an already-compromised container on the Docker network - which calls the model-runner.docker.internal API to pull that model and request an inference; MLX-LM importlib-loads the payload and runs it as the Docker Desktop user, yielding RCE on the developer's Mac. No public exploit was identified at time of analysis, but the primitive is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to achieve RCE on the host by tricking the MLX inference backend into loading a Python file from an attacker-controlled OCI model registry. The MLX-LM library imports the file referenced by config.json's model_file field via importlib without any trust_remote_code gate, and the backend runs unsandboxed as the Docker Desktop user. Patched in Docker Desktop 4.71.0; no public exploit identified at time of analysis and EPSS is very low (0.01%), but the SSVC technical impact is rated total.
Earlier versions of this analysis (2)
Arbitrary code execution in Docker Desktop's Model Runner (MLX inference backend) on macOS allows any container on the Docker network to execute Python code on the host by serving a malicious model whose config.json model_file points to an attacker-controlled Python script. The flaw stems from MLX-LM importing model_file via importlib without a trust_remote_code gate, and the MLX backend runs unsandboxed as the Docker Desktop user. Publicly available exploit code exists is not confirmed; this is reported as no public exploit identified at time of analysis, with a low EPSS score (0.01%) but high technical impact rated 'total' by SSVC.
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape to the host by serving a malicious model whose config.json points model_file at a Python file. The MLX inference backend uses MLX-LM's importlib-based loader with no trust_remote_code gate and no sandbox, so a pull-and-infer request to model-runner.docker.internal executes attacker code as the Docker Desktop user. No public exploit identified at time of analysis and KEV status is not indicated.
RemediationAI
Vendor-released patch: Docker Desktop 4.71.0 - upgrade macOS hosts to 4.71.0 or later as documented at https://docs.docker.com/desktop/release-notes/#4710. Where immediate upgrade is not possible, disable Docker Model Runner in Docker Desktop settings, or at minimum disable the MLX backend, which removes the vulnerable importlib path at the cost of losing local LLM inference. As a network-layer compensating control, prevent untrusted containers from reaching model-runner.docker.internal by avoiding running untrusted images on the default bridge network or by using user-defined networks that exclude the model runner; this preserves Model Runner functionality for trusted workflows but adds operational friction. Pulling models only from curated OCI registries reduces but does not eliminate risk, because any malicious config.json reaching the backend will be honored.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Docker Model Runner is the local LLM-serving feature shipped with Docker Desktop on Apple Silicon, which uses Apple's MLX framework and the MLX-LM Python library for inference. MLX-LM resolves a model's config.json model_file key as a module path and calls importlib to load it, a design intended to allow custom architecture code shipped alongside model weights. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) captures the root cause: unlike Hugging Face Transformers, which requires an explicit trust_remote_code=True opt-in for custom code, MLX-LM has no equivalent gate, so any pulled model can contribute executable Python to the host process. Affected CPE is cpe:2.3:a:docker:docker_desktop, and the exposure is reachable via the model-runner.docker.internal HTTP API exposed by default to containers on the Docker network.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (Docker) · only source for this CVE.
CVSS VectorVendor: Docker
Lifecycle Timeline
4DescriptionCVE.org
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user.
Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference.
Executive ViewAI
Docker Desktop's Model Runner on macOS contains a remote code execution vulnerability that could allow attackers to compromise development machines and CI/CD infrastructure by injecting malicious model files. Organizations relying on Docker for local development or container-based CI/CD face potential theft of source code, API credentials, and deployment secrets.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB