Docker Sandboxes
Monthly
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Docker Sandboxes can forward an unrecognized client-supplied credential in an alternate authentication header alongside the credential injected by the host egress proxy, potentially authenticating an outbound request to an attacker-controlled upstream account and exposing data included in that request. The proxy scrubs alternate credentials only when their values match known sentinel values, so untrusted code already running inside an authorized sandbox can bypass that removal if the targeted upstream service accepts another supported auth header. This is a local, moderate-severity confidentiality issue requiring sandbox code execution and credential injection to be enabled; no public exploit identified at time of analysis.
Docker Sandboxes credential-injection proxies can fail open and expose host-managed credentials - OAuth access and refresh tokens and a derived Anthropic API key - to code already running inside an authorized sandbox, defeating the masking control that is meant to keep those secrets outside the sandbox boundary. Exploitation requires an attacker to already have code executing in a sandbox configured to proxy host-managed credentials (PR:L) and depends on an edge condition where a proxied response-body read returns data together with an error, causing affected handlers to forward unmasked bytes instead of redacting them; because that error-plus-data condition is not guaranteed on every request (AT:P), reliability is limited and sandboxes that do not use credential injection are not affected. The vendor CVSS 4.0 base score is 5.9 and our independent assessment is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:N/C:H/I:N/A:N; no public exploit code or CISA KEV entry was identified at the time of analysis, and the primary limiting factor on real-world risk is that the attacker must operate from within the sandbox trust boundary.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Docker Sandboxes (sbx) fails to enforce read-only semantics on virtio-fs host mounts: the in-guest bind correctly receives the read-only flag, but the underlying host-edge grant omitted from the policy-share allowlist carries no access mode, leaving the shared-export path fully writable at the host level. Low-privileged code executing inside the sandbox can enumerate or derive the virtio-fs export path and write to host directories the operator explicitly attached as read-only, breaking the isolation guarantee that is the product's core security promise. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Docker Sandboxes can forward an unrecognized client-supplied credential in an alternate authentication header alongside the credential injected by the host egress proxy, potentially authenticating an outbound request to an attacker-controlled upstream account and exposing data included in that request. The proxy scrubs alternate credentials only when their values match known sentinel values, so untrusted code already running inside an authorized sandbox can bypass that removal if the targeted upstream service accepts another supported auth header. This is a local, moderate-severity confidentiality issue requiring sandbox code execution and credential injection to be enabled; no public exploit identified at time of analysis.
Docker Sandboxes credential-injection proxies can fail open and expose host-managed credentials - OAuth access and refresh tokens and a derived Anthropic API key - to code already running inside an authorized sandbox, defeating the masking control that is meant to keep those secrets outside the sandbox boundary. Exploitation requires an attacker to already have code executing in a sandbox configured to proxy host-managed credentials (PR:L) and depends on an edge condition where a proxied response-body read returns data together with an error, causing affected handlers to forward unmasked bytes instead of redacting them; because that error-plus-data condition is not guaranteed on every request (AT:P), reliability is limited and sandboxes that do not use credential injection are not affected. The vendor CVSS 4.0 base score is 5.9 and our independent assessment is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:N/C:H/I:N/A:N; no public exploit code or CISA KEV entry was identified at the time of analysis, and the primary limiting factor on real-world risk is that the attacker must operate from within the sandbox trust boundary.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Docker Sandboxes (sbx) fails to enforce read-only semantics on virtio-fs host mounts: the in-guest bind correctly receives the read-only flag, but the underlying host-edge grant omitted from the policy-share allowlist carries no access mode, leaving the shared-export path fully writable at the host level. Low-privileged code executing inside the sandbox can enumerate or derive the virtio-fs export path and write to host directories the operator explicitly attached as read-only, breaking the isolation guarantee that is the product's core security promise. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.