Critical Docker Sandboxes Flaw Let Malicious Code Escape to macOS Host Files

Docker has warned of a critical flaw in its Sandboxes feature on macOS that could let malicious code running inside a virtual machine break out and access files elsewhere on the host computer. The vulnerability, CVE-2026-77179, affects versions 0.28.0 up to but not including 0.42.0, and was fixed in version 0.42.0 released on September 7.

Docker Sandboxes is designed to run AI coding agents inside isolated virtual machines, with only the project directory shared between the host and the guest. The flaw meant that if an agent was tricked into running malicious code, or installed something harmful itself, it could exploit a weakness in the file sharing system to replace a directory with a symlink. This allowed it to read or change files outside the intended project folder, using the permissions of the host account running the virtual machine, potentially leading to code execution on the host.

Docker says it has not seen this flaw exploited, and CISA's assessment lists no known exploitation as of mid September. The same update also fixed a second, high severity flaw affecting how sandboxes connect to certain system sockets. Businesses using Docker Sandboxes for AI assisted development should treat this as a reminder that sandbox boundaries can fail and updates should be applied promptly.