Executive brief
Docker Desktop for macOS contains a security flaw in its Model Runner component, which is used to run AI models locally. An attacker can create a malicious AI model that, when loaded, automatically executes hidden code on the user's computer. This could allow an attacker to take control of the system, steal data, or disrupt operations, especially since the malicious code runs with the same permissions as the Docker Desktop user.
Technical details
The MLX inference backend in Docker Model Runner for macOS utilizes the MLX-LM library, which is vulnerable to arbitrary code execution. The vulnerability stems from the library unconditionally importing and executing Python files specified in the 'model_file' field of a model's config.json using 'importlib' without a 'trust_remote_code' gate. Because the MLX backend runs without sandboxing on the host, an attacker can achieve code execution as the Docker Desktop user. An attacker can trigger this by hosting a malicious model in an OCI registry and inducing a container on the Docker network to call the 'model-runner.docker.internal' API to pull and run inference on that model. The issue is addressed in Docker Desktop version 4.71.0.
Affected products
- Docker Docker Desktop 4.56.0 to 4.71.0
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
- 2026-06-01: patched: NVD updated with fix version 4.71.0