Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

A critical vulnerability (CVE-2026-77179) in Docker Sandboxes allows malicious code running within a virtual machine to escape its confines and read or modify files on the host operating system. This vulnerability, discovered by Oren Yomtov and Jurre van Bergen, stems from a symlink mechanism and could lead to arbitrary code execution on the host. Docker has released a fix in version 0.42.0, and recommends clone mode as a mitigation for users unable to update immediately.

Docker Sandboxes runs each AI coding agent in its own small virtual machine with the project directory shared in. The code that could escape is whatever runs inside that machine, such as a coding agent that has been turned against its user, or anything malicious the agent installs and runs. Docker has not reported any exploitation of this vulnerability as of September 16, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

The vulnerability is due to a symlink mechanism. A guest, meaning whatever runs inside the virtual machine, could replace a parent directory with a symlink and then read or change files as the VMM user, the host account under which the virtual machine monitor runs. This could potentially lead to code execution on the host.

Docker published the CVE records and the advisory on September 15, eight days after 0.42.0 shipped. The 0.42.0 release notes on GitHub and on Docker's documentation site do not name either CVE as of September 17. Among routine fixes, they list one for "a sandboxed process could get the daemon to open a host D-Bus transport and execute an arbitrary command on the host." Docker has not connected that fix to either CVE.

Docker credits Oren Yomtov of accomplish.ai with finding CVE-2026-77179 and Jurre van Bergen of ThreatNotify with finding CVE-2026-79994.

As of September 17, the most recent release is 0.43.0, published on September 15. If you cannot update yet, use clone mode and avoid adding read-write host mounts. Clone mode protects the repository from changes, not from reading. The repository is mounted read-only at /run/sandbox/source, and untracked files such as .env stay readable inside the sandbox.