Executive brief
Docker Model Runner on macOS contains a security flaw in its AI model processing component. An attacker can use a malicious AI model to execute unauthorized code on the host computer with the privileges of the Docker Desktop user. This could lead to full system compromise, data theft, or persistent access to the user's machine.
Technical details
The vllm-metal inference backend in Docker Model Runner (DMR) on macOS unconditionally sets 'trust_remote_code=True' when calling 'transformers.AutoTokenizer.from_pretrained()'. Because the backend runs without sandboxing, it imports and executes arbitrary Python files included in any model pulled from an OCI registry. An attacker can trigger this by sending a request to the 'model-runner.docker.internal' API from any container on the Docker network to pull a malicious model and initiate inference. This results in arbitrary code execution on the Docker host as the Docker Desktop user. The issue is addressed in Docker Desktop version 4.68.0.
Affected products
- Docker Docker Desktop 4.62.0 to 4.68.0
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
- 2026-06-01: other: NIST analysis completed