EUVD-2026-78467
GHSA-4x2g-7mfh-8rx6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker runs inside the guest so AV:L and PR:N (no host creds); escaping the sandbox to the host changes security authority, hence S:C with full C/I/A on host files.
Primary rating from Vendor (Docker).
CVSS VectorVendor: Docker
Lifecycle Timeline
4DescriptionCVE.org
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
Articles & Coverage 2
AnalysisAI
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already control a guest workload running inside a Docker Sandbox on macOS (versions 0.28.0 through 0.41.x) with a shared workspace bind-mount served over the virtio-fs host server - this is the default for 'sbx run', which mounts the current directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine sandbox-escape leading to host compromise, but the raw 9.4 CVSS 4.0 score should be read alongside the other signals rather than at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Docker Sandboxes for macOS to 0.42.0 or later, which is the release that closes out the affected 0.28.0 <0.42.0 range and is published at https://github.com/docker/sbx-releases/releases/tag/v0.42.0; consult the vendor documentation at https://docs.docker.com/ai/sandboxes/security/isolation/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-77179 for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every macOS host running Docker Sandboxes and confirm which systems fall in the affected 0.28.0 through 0.41.x range; where the vendor-fixed release named in Docker's advisory is available (any release above the affected 0.41.x line), upgrade those hosts immediately, and until the upgrade lands, stop running untrusted agent workloads or untrusted repositories inside Docker Sandboxes or move that work to disposable macOS hosts that hold no production credentials or signing material. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today