Docker Sandboxes EUVD-2026-116532

Exploitation requires the attacker to be able to write to a host repository's Git configuration - concretely, a direct-mode Docker Sandbox with that repository mounted read-write, which lets the attacker set core.fsmonitor or another Git setting that invokes an external program. The payload only executes when the user subsequently performs a clone-mode fetch, or (in versions 0.39.0 and later) an sbx kit push, so a victim-initiated Git operation is a hard prerequisite (UI:A). Limiting factors: the vector is local, not network; a clone-mode sandbox's read-only host-repository mount cannot modify the Git configuration, so that path is not exploitable; the attacker needs a pre-existing read-write sandbox foothold; and the issue is fully fixed in version 0.50.0, which the vendor presents as the remedy.

The vendor-assigned CVSS 4.0 score is 7.1 (High) with vector AV:L/AC:L/AT:P/PR:N/UI:A and VC:H/VI:H/VA:H, meaning full compromise of the host (confidentiality, integrity, availability) but only via a local vector that requires a present attack condition (AT:P) and active user interaction (UI:A). This is materially more serious than the 'Information Disclosure' tag suggests - the real impact is arbitrary program execution on the host outside the microVM isolation boundary, i.e. a sandbox-escape leading to code execution as the invoking user. No EPSS score, no CISA KEV listing, and no proof-of-concept reference are present in the supplied data (the only references are Docker documentation and the v0.50.0 release notes), so exploitation is unproven in the wild. The vuln.today decision label is 'this_week', consistent with a real but not emergency priority: exploitation is not trivially remote or automatable - it needs an attacker who already has a direct-mode sandbox with the repository mounted read-write, plus a later victim-initiated clone-mode fetch or sbx kit push to fire the poisoned Git setting. Net: a genuine high-impact sandbox-escape worth patching promptly, but the local vector, required foothold, and required user action reduce the likelihood of opportunistic mass exploitation. PR:N is reported by the vendor, yet in practice the attacker must first control a read-write host-repository mount, so treat 'unauthenticated' with that caveat.

An attacker who already operates a direct-mode Docker Sandbox with a host repository mounted read-write edits that repository's .git configuration to set core.fsmonitor (or another setting that invokes an external program). Later, when the legitimate user runs a clone-mode fetch, or an sbx kit push on versions 0.39.0 and above, host-side Git executes the attacker's program on the host with the user's permissions, escaping the microVM. No public exploit code is identified in the supplied data.