Docker Desktop
Monthly
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape to the host by serving a malicious model whose config.json points model_file at a Python file. The MLX inference backend uses MLX-LM's importlib-based loader with no trust_remote_code gate and no sandbox, so a pull-and-infer request to model-runner.docker.internal executes attacker code as the Docker Desktop user. No public exploit identified at time of analysis and KEV status is not indicated.
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Docker network to execute Python code on the host as the Docker Desktop user. The vllm-metal backend hardcodes trust_remote_code=True when loading tokenizers and runs unsandboxed, so any model pulled from an OCI registry can ship attacker-controlled Python that executes when inference is requested via the model-runner.docker.internal API. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Enhanced Container Isolation (ECI) bypass in Docker Desktop allows a local low-privileged user with Docker CLI access to mount the Docker Engine socket into a container by invoking the --use-api-socket flag, granting full Docker Engine control and exposure of registry credentials. The flaw stems from the API proxy inspecting only HostConfig.Binds while the flag routes the mount through HostConfig.Mounts, slipping past ECI policy. No public exploit identified at time of analysis, but the issue was reported by Docker itself and disclosed via ZDI (ZDI-26-299).
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape to the host by serving a malicious model whose config.json points model_file at a Python file. The MLX inference backend uses MLX-LM's importlib-based loader with no trust_remote_code gate and no sandbox, so a pull-and-infer request to model-runner.docker.internal executes attacker code as the Docker Desktop user. No public exploit identified at time of analysis and KEV status is not indicated.
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Docker network to execute Python code on the host as the Docker Desktop user. The vllm-metal backend hardcodes trust_remote_code=True when loading tokenizers and runs unsandboxed, so any model pulled from an OCI registry can ship attacker-controlled Python that executes when inference is requested via the model-runner.docker.internal API. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Enhanced Container Isolation (ECI) bypass in Docker Desktop allows a local low-privileged user with Docker CLI access to mount the Docker Engine socket into a container by invoking the --use-api-socket flag, granting full Docker Engine control and exposure of registry credentials. The flaw stems from the API proxy inspecting only HostConfig.Binds while the flag routes the mount through HostConfig.Mounts, slipping past ECI policy. No public exploit identified at time of analysis, but the issue was reported by Docker itself and disclosed via ZDI (ZDI-26-299).