CVE-2024-21626

CVE-2024-21626 For detailed explanation for this vulnerability, plz refer to my article. Exploit Exploit via Running a Container No need to build a custom image, just run a container with -w parameter: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Exploit via Execin...

CVE-2026-5843

CVE-2026-5843 PoC Minimal OCI registry that serves a malicious model to exploit the modelfile importlib execution path in mlx-lm. When Docker Model Runner loads the model for inference, model.py executes on the host as the logged-in user. Requires: Docker Desktop ≤ 4.70.x Apple Silicon with Model...

cve-2024-21626-runc-1.1.11-escape

CVE-2024-21626 - runc Leaky Vessels Overview Field| Detail ---|--- CVE| CVE-2024-21626 Affected Component| runc ≤ 1.1.11 Vulnerability Class| Container escape via file descriptor leak Nickname| Leaky Vessels Root Cause runc leaks an internal file descriptor typically fd/7 pointing to the host...

HTB-Silentium-Writeup

HTB - Silentium Writeup Machine Info Name: Silentium OS: Linux Difficulty: Easy CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeration Nmap Scan nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Open ports: 22 SSH, 80 HTTP Virtual Hostsstaging.silentium.htb runs Flowise 3.0.5 Foothold —...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour This code is for educational purposes only and controlled environments such as laboratories Hack The Box. Do not use on systems without authorization. This repository contains an exploit script for the Docker Remote API exposed without authentication...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vunlerability Severity: Critical CVSS 9.8 Component: opencontainers/runc libcontainer Vulnerability Type: CWE-59: Improper Link Resolution Before File Access 'Link Following' 🚨 Executive Summary A critical vulnerability exists in runc's...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

copy_fail

copyfail Research Notes CVE-2026-31431 English 简体中文 This repository is a defensive research workspace for studying the Linux copyfail vulnerability tracked as CVE-2026-31431. The goal of this repository is to preserve analysis notes, document impact, and support safe local assessment. It is not...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: Docker Desktop Container Escape PoC Proof of Concept exploit for CVE-2025-9074 - a critical container escape vulnerability in Docker Desktop that allows unauthenticated access to the Docker Engine API. Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-9074 CVSS Score|...

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

docker_cve-2015-2925

Docker + CVE-2015-2925 = escaping from --volume Recent vulnerability in Linux known for about half of the year several months publicly made it possible to escape from bind mounts. In particular in case of Docker it's possible to escape from inside the directory mounted via --volume option to the...

RunC-CVE-2019-5736

RunC-CVE-2019-5736 Two PoCs for CVE-2019-5736. See Twistlock Labs for an explanation of CVE-2019-5736 and the PoCs. The malicious image PoC is heavily based on q3k’s PoC, so all credit goes to him. Running the PoCs Note that running the PoCs will overwrite the runc binary on the host. It is...

cve-2025-49131-poc

CVE-2025-49131 - FastGPT Sandbox Escape POC ███████╗ █████╗ ███████╗████████╗ ██████╗ ██████╗ ████████╗ ██╔════╝██╔══██╗██╔════╝╚══██╔══╝██╔════╝ ██╔══██╗╚══██╔══╝ █████╗ ███████║███████╗ ██║ ██║ ███╗██████╔╝ ██║ ██╔══╝ ██╔══██║╚════██║ ██║ ██║ ██║██╔═══╝ ██║ ██║ ██║ ██║███████║ ██║ ╚██████╔╝██║...

ipv6_frag_escape

IPV6FRAGESCAPE — Linux IPv6 fragmentation container escape tracking site Source for the IPV6FRAGESCAPE patch-status tracker: a single-page site recording which distributions have shipped a fix for the IPv6 fragmentation container escape in the Linux kernel. Where the facts live Everything about t...

CVE-2022-0492-Docker-Breakout-Checker-and-PoC

CVE-2022-0492 Docker Breakout Checker and PoC Summary Exploiting the vulnerability requires the attacker to have access to a Docker container running on a vulnerable system. Once exploited, the attacker can escape the container and gain complete control over the host system. A vulnerability was...

mks-copy-fail-mitigation

Copy Fail Mitigation DaemonSets DaemonSets for fixing vulnerabilities of the Copy Fail family on all worker nodes of MKS clusters. Contents CVE-2026-31431 Copy Fail CVE-2026-43284, CVE-2026-43500, CopyFail2 Dirty Flag CVE-2026-31431 Copy Fail Vulnerability Description CVE ID: CVE-2026-31431 CVE...

CVE-2026-31431

CVE-2026-31431 Structure . ├── container │ ├── container.md Container escape ideas │ ├── expenv Container environment │ │ ├── bin │ │ │ ├── gscontainer │ │ │ └── share │ │ ├── Dockerfile │ │ ├── run.sh │ │ └── src │ │ ├── gscontainer.c │ │ └── share.c │ ├── images │ │ ├── container.png │ │ ├──...

CVE_2026_31431

CVE-2026-31431 Copy Fail – a 4‑byte page‑cache write primitive in the Linux kernel's authencesn AEAD template, exploitable via AFALG + splice. CVE-2026-31431 is a deterministic, race‑free logic bug in the Linux kernel. An unprivileged local user can overwrite 4 bytes in the page‑cache of any...

container-escape-ebpf

White Paper https://www.scs-europe.net/dlib/2026/2026-0321.html Assumptions Host runs vulnerable version of runc: For CVE-2025-31133: 1.2.7 and below, 1.3.0-rc.1 through 1.3.2, 1.4.0-rc.1 and 1.4.0-rc.2. For CVE-2024-21626: 1.0.0-rc93 through 1.1.11. Unprivileged user is able to create containers...