Docker patches critical macOS escape in Docker Sandboxes

Docker has patched two vulnerabilities in Docker Sandboxes, including CVE-2026-77179, a critical macOS flaw with a CVSS score of 9.4. Malicious code running inside a sandbox virtual machine could escape the shared project directory and read or modify files elsewhere on the Mac under the permissions of the host account running the virtual machine monitor.

The critical issue affects Docker Sandboxes versions 0.28.0 up to, but not including, 0.42.0. Docker fixed it in version 0.42.0, released on September 7; version 0.43.0, released on September 15, was the latest version as of September 17.

Symlink handling undermined the workspace boundary

Docker Sandboxes isolates each AI coding agent in a small virtual machine while sharing the project directory into that environment. The product is designed around the hypervisor boundary rather than privilege separation inside the guest, where agents can install packages and execute commands with sudo.

CVE-2026-77179 lies in the virtio-fs host server that supports file sharing between the Mac and the virtual machine. Docker said the server followed symlinks when reopening a removed file from a stored path. A guest could replace a parent directory with a symlink, causing the host-side service to access files outside the workspace as the VMM user. Docker said this could potentially lead to code execution on the host.

The behaviour conflicts with Docker documentation stating that symlinks pointing outside the workspace are not followed. The practical consequence is significant for teams giving coding agents access to repositories: code executed by an agent, including a malicious dependency it installs, is precisely the workload the sandbox is intended to constrain.

Second flaw affects Unix socket connections

The same release fixes CVE-2026-79994, rated High with a CVSS score of 8.7. It affects versions 0.37.0 through 0.41.9 and concerns the relay that lets a sandbox connect to Unix domain sockets inside its authorised workspace.

The relay verified that a socket path was within the workspace, then reconnected using that pathname. By replacing a directory in the path with a symlink between validation and connection, a guest could make the host connect to an AF_UNIX socket outside the workspace. Docker said this could expose data or host-side capabilities supplied by that socket.

Docker reported no exploitation for either vulnerability. CISA's CVE assessments list exploitation as none, and neither issue was present in CISA's Known Exploited Vulnerabilities catalog as of the September 16 catalog release.

Update and review fallback configurations

Docker advises customers to update to version 0.42.0 or later. Where an immediate upgrade is not possible, it recommends clone mode and avoiding read-write host mounts. By default, sbx run shares the current directory with read and write access.

Clone mode requires a Git repository and is selected when the sandbox is created, meaning existing sandboxes must be removed and recreated with --clone. It protects the repository from modification rather than disclosure: the repository remains readable at /run/sandbox/source, and untracked files, including .env files, can still be read inside the sandbox.

For businesses deploying AI coding agents, the immediate implication is to inventory Docker Sandboxes on macOS, update affected installations, and treat clone mode as a temporary reduction in write exposure rather than a complete safeguard for secrets or host resources.