Docker Sandboxes Flaw Rated 9.4 Let Code Escape to Mac Host

Docker disclosed a critical flaw on September 15, 2026 in Docker Sandboxes, the tool that runs each AI coding agent inside its own small virtual machine on a developer's computer with only the project directory shared in. On macOS, code running inside that sandbox could escape the shared workspace and read or modify any file on the host. Docker, which assigned the record, rated CVE-2026-77179 at 9.4 out of 10, Critical.

According to the vendor description in the National Vulnerability Database entry, the virtio-fs host server — the host side of the file sharing between the Mac and the virtual machine — improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the workspace and read or modify arbitrary host files as the VMM user, "potentially achieving host code execution." The same release fixed a second symlink race, CVE-2026-79994, which Docker rated High at 8.7: in the relay that lets a sandbox reach Unix domain sockets inside its workspace, a guest could swap a directory for a symlink between the path check and the connection, and reach sockets outside it.

The patch came first and the paperwork second. Version 0.42.0 shipped on September 7, 2026, according to Docker's release page on GitHub; the CVE records followed on September 15, eight days later, as The Hacker News noted in its September 17 write-up. Those release notes now list both CVE numbers under a Security heading. The critical flaw affects versions 0.28.0 up to but not including 0.42.0 on macOS; the second affects 0.37.0 up to 0.42.0.

The reason this matters is the product's purpose. Docker Sandboxes exists so that an AI coding agent, which installs packages and runs commands with sudo inside the virtual machine, cannot touch the host — and Docker's own isolation documentation states that the hypervisor boundary "is the isolation control, not in-VM privilege separation." A hole in the file-sharing layer undoes that guarantee. The attack requires code already running inside the sandbox, and the vector recorded in the NVD entry classes it as local — but hostile code in the sandbox is precisely what the product is sold to contain: an agent turned against its user, or anything malicious that agent installs and runs.

Docker has reported no exploitation. CISA's added assessment on the CVE record lists exploitation as none, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog as of the version released on September 16. Docker credits Oren Yomtov of accomplish.ai with the critical flaw and Jurre van Bergen of ThreatNotify with the second. The fix is to update to 0.42.0 or later. For anyone who cannot update yet, Docker's advice for both flaws is clone mode and no read-write host mounts — with limits worth knowing: clone mode works only on Git projects, must be set when the sandbox is created, and protects the repository from changes rather than from reading, so untracked files such as .env stay readable inside it.