Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

A critical vulnerability in Docker Sandboxes for macOS, tracked as CVE-2026-77179, allows malicious guest code running inside a virtual machine to escape the sandbox and read or modify arbitrary files on the host system by exploiting symlink handling in the virtio-fs host server. The flaw affects Docker Sandboxes versions 0.28.0 to 0.41.9 and was patched in version 0.42.0. A second high-severity issue, CVE-2026-79994, enables symlink-based path traversal to access Unix domain sockets outside the authorized workspace. No active exploitation has been reported, and both vulnerabilities were addressed in the same update.

AI-extracted · verify before operational use