# CVE-2026-121614: Docker Sandboxes arbitrary code execution via Git configuration

Source: https://junglewise.ai/threats/cve-2026-121614-docker-sandboxes-versions-0-31-0-before-0-50-0-do-not-neutralize  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121614 · Severity: info · Published 2026-11-03

Docker Sandboxes is a containerization tool that runs applications in isolated microVMs. Versions 0.31.0 through 0.49.x fail to sanitize Git configuration settings, allowing an attacker with write access to a repository to inject commands that execute on the host with the user's permissions when Git operations occur. This bypasses the sandbox isolation, potentially leading to data theft, system compromise, or lateral movement.

Technologies: [Docker Sandboxes](https://junglewise.ai/threats/technologies/sandboxes). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker).

## Quick answers

**Is CVE-2026-121614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121614 being exploited in the wild.

**How severe is CVE-2026-121614?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Docker Sandboxes 0.31.0 before 0.50.0.

**Is there a fix for CVE-2026-121614?** Yes: fixed in 0.50.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121614 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-121614?** Check whether you run Docker Sandboxes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.50.0

## Technical details

The vulnerability stems from insufficient neutralization of repository-controlled Git configuration (core.fsmonitor and similar settings) when Docker Sandboxes runs host-side Git commands. An attacker who modifies a repository's Git configuration—either directly in a read-write mounted sandbox or through previous access—can specify an external program to execute. When a clone-mode sandbox initiates a fetch or (in v0.39.0+) a kit push, Git runs the attacker's program on the host outside the microVM isolation with the invoking user's permissions.

## Affected products

- Docker Sandboxes 0.31.0 before 0.50.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://docs.docker.com/ai/sandboxes/](https://docs.docker.com/ai/sandboxes/)
- [https://docs.docker.com/ai/sandboxes/security/isolation/](https://docs.docker.com/ai/sandboxes/security/isolation/)

## Related threats

- [Docker Sandboxes host-port republication after removal](https://junglewise.ai/threats/cve-2026-126330-docker-sandboxes-can-silently-republish-a-sandbox-service-after)
- [Docker Sandboxes privilege escalation via directory ownership](https://junglewise.ai/threats/cve-2026-126329-docker-sandboxes-reuses-existing-state-and-configuration)
- [Docker Sandboxes sbx cp path traversal via symlink](https://junglewise.ai/threats/cve-2026-103916-docker-sandboxes-sbx-cp-does-not-safely-confine-host-side-paths)
- [Docker Sandboxes AF_UNIX socket symlink bypass](https://junglewise.ai/threats/cve-2026-79994-docker-sandboxes-af-unix-socket-symlink-bypass)
- [Docker Sandboxes virtio-fs symlink escape on macOS](https://junglewise.ai/threats/cve-2026-77179-docker-sandboxes-virtio-fs-symlink-escape-on-macos)