**Docker** has issued a security announcement regarding a critical vulnerability, **CVE-2026-77179**, affecting **Docker Sandboxes** on macOS. This flaw could permit malicious code executing within a sandbox's virtual machine to escape its isolated environment and gain unauthorized access to the host system. ### The Critical Host Escape Vulnerability The vulnerability, rated Critical with a **CVSS** score of 9.4, allows an attacker to read or modify files anywhere on the host machine. This escape operates with the privileges of the host account running the virtual machine. **CVE-2026-77179** impacts **Docker Sandboxes** versions 0.28.0 up to, but not including, 0.42.0 on macOS. The issue was resolved in version 0.42.0, released on September 7. **Docker Sandboxes** are designed to run **AI** coding agents within isolated virtual machines, sharing only the project directory. The vulnerability implies that any malicious code, such as a compromised coding agent or malicious software installed by an agent, could exploit this flaw. While **Docker** has not reported any exploitation in the wild, and **CISA's** assessment also lists no known exploitation, the severity of the flaw highlights the importance of timely updates. ### Technical Details of the Escape The escape mechanism leverages a weakness in the **virtio-fs host server**, which manages file sharing between the macOS host and the virtual machine. **Docker** explained that the server followed symbolic links when reopening a removed file from a stored path. A guest within the virtual machine could replace a parent directory with a symlink, allowing it to read or modify files as the **VMM** user (the host account under which the virtual machine monitor runs), potentially leading to code execution on the host. It's worth noting that **Docker's** documentation has stated since March that symlinks pointing outside the workspace (the shared project directory) are not followed. This incident underscores the complexities of maintaining strict isolation boundaries. ### Secondary High-Severity Flaw The same update also addresses **CVE-2026-79994**, a high-severity vulnerability (CVSS score 8.7) in the relay that facilitates connections to Unix domain sockets within a sandbox's authorized workspace. This flaw affects versions 0.37.0 through 0.41.9. In this scenario, the relay would verify a socket path's location within the workspace, then reconnect using that path. An attacker could replace a directory along the path with a symlink between the check and the connection, forcing the host to connect to any **AF_UNIX** socket outside the workspace. This could expose data or host-side capabilities provided by that socket. Unlike **CVE-2026-77179**, which is macOS-specific, **CVE-2026-79994** does not specify a platform, suggesting it could affect **Docker Sandboxes** on macOS, Windows, and Linux hosts. No exploitation of this vulnerability has been reported either. ### Affected Versions and Remediation | CVE | Component | Affected Versions | Platform | Docker Rating | | :------------- | :------------------------ | :-------------------------------------- | :------- | :-------------------- | | **CVE-2026-77179** | virtio-fs host server | 0.28.0 up to but not including 0.42.0 | macOS | Critical, CVSS 9.4 | | **CVE-2026-79994** | Guest-to-host Unix socket relay | 0.37.0 up to but not including 0.42.0 | None stated | High, CVSS 8.7 | **Recommendations for IT Security Professionals and Users:** 1. **Immediate Update:** Update **Docker Sandboxes** to version 0.42.0 or later. As of September 17, the most recent release is 0.43.0. 2. **Mitigation:** If an immediate update is not possible, utilize 'clone mode' and avoid adding read-write host mounts. This is **Docker's** advice for both vulnerabilities. 'Clone mode' is applicable only for Git repositories and needs to be set when the sandbox is created (using `--clone`). While this mode protects the repository from modifications by mounting it read-only, untracked files like `.env` remain readable within the sandbox. **Docker** published the CVE records and advisory on September 15, eight days after version 0.42.0 was released. The release notes for 0.42.0 on **GitHub** and **Docker's** documentation did not initially name either **CVE**, listing a more general fix for a sandboxed process gaining daemon access. **Docker** has since credited Oren Yomtov of **accomplish.ai** for discovering **CVE-2026-77179** and Jurre van Bergen of **ThreatNotify** for **CVE-2026-79994**. This incident follows a report in April by **Cyera Research Labs**, which detailed how a prompt-injected coding agent within a **Docker**-based sandbox could be manipulated to exploit a separate **Docker Engine** flaw against its host. These recurring issues highlight the ongoing challenges in securing containerized and virtualized environments, particularly those interacting with AI agents.