The escape
Docker Sandboxes' virtio-fs host server on macOS followed symlinks when reopening an unlinked file from a stored path. A malicious guest could replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the virtual-machine-manager user — which lands at host code execution.
The framing vs. the record
The discovery blogger framed it as complete read-write to the host filesystem in three lines of bash, and noted Docker's virtual-machine mode becomes the default for Docker Desktop at the end of October 2026. The NVD record is more restrained: CVSS 9.4, macOS only, affecting 0.28.0 through below 0.42.0, not in KEV, EPSS under one percent. The three-line and end-of-October framing is the author's, not NVD's.
The same researcher, Oren Yomtov of Accomplish AI, reported both this and the Codex escapes. It is worth linking the two, because together they read as one researcher mapping the boundary between an agent's sandbox and the host it runs on.
The fix
The CVE was published September 15 and fixed in Docker Sandboxes 0.42.0 (September 7) and Docker Desktop 4.88.0.
Sources
Research
Thread
- Relates to: Codex read its way out of read-only
- Related to: Configure a flow, run a command
- Related to: One symlink unlocked every credential
Both are a symlink that walks a sandbox out to host paths it was never granted; there the mount layer followed it, here the operator-supplied project path did.
- Related to: Twenty-five agent CVEs in two days, from one researcher
Same recurring escape primitive: a containment check that inspects the attacker-influenced string rather than the filesystem object it resolves to. mistral.rs, MoAI-ADK, and open-multi-agent all follow a symlink past a path check that never called lstat.
- Related to: Loading libc without an import statement
- Related to: Eleven escapes once the network was allowed
- Related to: Fifty thousand dollars for a guest-to-host escape
- Related to: Sandboxed until the first semicolon
Both are agent sandboxes that let the confined party reach the host. There the host server followed a symlink out of the shared workspace; here the sandbox wrapper covered only the first command, so a semicolon ran the rest as root.
- Related to: Fine when checked, a symlink when written
Semantic neighbors
- One symlink unlocked every credential78% similar
- Codex read its way out of read-only76% similar
- Fifty thousand dollars for a guest-to-host escape75% similar