Executive brief
Docker Sandboxes on macOS uses a virtio-fs file sharing mechanism to allow containers to access files on the host machine. A malicious container can exploit improper symlink handling to bypass sandbox restrictions, gain access to files outside the shared workspace, and potentially execute code on the host computer with the same privileges as the hypervisor process.
Technical details
The vulnerability is a symlink following bypass in the virtio-fs host server used by Docker Sandboxes on macOS. When reopening a previously unlinked file from a stored path, the server improperly follows symlinks instead of using the original inode reference. An attacker with guest-level access can replace a parent directory with a symlink, causing the file reopening logic to traverse into arbitrary host filesystem locations. This allows reading and modifying arbitrary files accessible to the VMM user, potentially leading to host code execution. The attack requires guest-level access but does not require additional user interaction or network connectivity.
Affected products
- Docker Sandboxes
Timeline
- 2026-09-15: disclosed