cve-2019-5736-exp

cve-2019-5736-exp This is a proof-of-concept PoC exploit for the CVE-2019-5736 vulnerability in runc, the runtime used in Docker. Disclaimer I undertook this project as an exercise, for educational reasons and for fun. It should go without saying that I do not support unethical and/or illegal...

coolify-cve-2025-66209-66213

Coolify Security Advisories - CVE-2025-66209 through CVE-2025-66213 Reporter: 0xrakan Vendor: coollabsio/coolify Affected Versions: v4.0.0-beta.451 Fixed Version: v4.0.0-beta.451 Severity: Critical CVSS 9.4 Overview Five critical authenticated command injection vulnerabilities were discovered in...

CVE-2025-9074-PoC-Bash

CVE-2025-9074-PoC-Bash The original PoC is: https://github.com/j3r1ch0123/CVE-2025-9074. This is new PoC in bash since not all docker containers has python installed, and mostly this should be run from inside a container. Steps From inside the container use the following to find vulnerable docker...

docker_lightman_exploit

Docker Lightman Exploit Docker CVE-2022-37708. This exploit relies on how the UNIX filesystem has UID and GID on files that Docker shares between the Host running the Docker and the Client being run within the Docker as well as relies on the nature of how Process ID ownership works. The Problem i...

cve-2025-23266-migration-bypass

cve-2025-23266-migration-bypass cve-2025-23266-migration-bypass two method given to get flag's content: 1. copy it from host into container's mounted dir; 2. use reverse shell to get it;...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file descriptors used var...

CVE-2019-5736-PoC

Usage PoC was created to the scenario were victim is executing for example docker exec sh. Before running exploit it's required to overwrite sh binary in the container file system: printf '!/proc/self/exe' /bin/sh After that, when victim executes exec command, runc binary in the host file system...

CVE-2025-9074-Poc

Docker API Unauthenticated RCE CVE-2025-9074 A critical CVE-2025-9074 vulnerability in Docker Desktop enables locally running Linux containers to connect to the Docker Engine API through the default subnet 192.168.65.7:2375. The issue persists regardless of Enhanced Container Isolation ECI or TCP...

POC-CVE-2019-5736

RunC-CVE-2019-5736 Video : https://bit.ly/2WqvILb Blog Post : www.idealhax.blogspot.com/2020/05/breaking-out-of-docker-via-runc.html Here, I like to mention that the original developer of this exploit is Yuval Avrahami at Twistlock Labs. Running the POCs Note that running the POCs will overwrite...

can-ctr-escape-cve-2022-0492

A container image that tests whether a container enviroment is vulnerable to escapes via CVE-2022-0492. Best to execute under a new container running an image built with: $ cd can-ctr-escape-cve-2022-0492 $ docker build -t can-ctr-escape-cve-2022-0492:latest . A pre-built image is available at...

CVE-2019-5736-PoC

CVE-2019-5736-PoC PoC for CVE-2019-5736 Created with help from @singe, @cablethief, and @feexd Tested on Ubuntu 18.04, Debian 9, and Arch Linux. Docker versions 18.09.1-ce and 18.03.1-ce. This PoC does not currently work with Ubuntu 16.04 and CentOS. Go checkout the exploit code from Dragon Secto...

CVE-2022-0847-container-escape

CVE-2022-0847 A simple exploit that uses dirtypipe to inject shellcode into runC entrypoint to implement container escapes. Usage Produce base64 encoded shellcode using msf: $ msfvenom -p linux/x64/exec CMD="" -f base64 Compile and run in the container, the overwritten filename is the bin that ru...

CVE-2024-21626

about Steps to reproduce ensure kernal = 5.4,4.19,.. and there is openat2 in /proc/kallsyms. v1.0.0-rc93= runc =1.1.11 $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2...

bad_garbage

BADGARBAGE.c CVE-2026-53361 — an unprivileged, container-escapable use-after-free in the AFUNIX socket garbage collector. This is the single-vector MSGPEEK only version. The Bug The AFUNIX GC reclaims "in-flight" sockets that form unreachable reference cycles. A concurrent MSGPEEK on an in-flight...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC CVE-2026-17106 published by the Imperva Red Team Ron Masas , with the code identical to upstream; upstream does not include a...

CVE-2026-41567

CVE-2026-41567 1day One day for Docker Escape CVE-2026-41567. It is a demonstration of docker escape using trojanized xz / unpigz. It can be easily modified to be used remotely i.e. just modify the docker default IP with a remote C2. More information on the exploit here PoC Run a netcat listening...

CopyEscape-CVE-2026-17106

CopyEscape: Taking Over Docker Hosts with docker cp CVE-2026-17106 This is the proof-of-concept repository for the blog post CopyEscape: Taking Over Docker Hosts withdocker cp — CVE-2026-17106. CopyEscape allows a malicious running container to race Docker's archive producer and create an...

CVE-2026-5843

CVE-2026-5843 PoC Minimal OCI registry that serves a malicious model to exploit the modelfile importlib execution path in mlx-lm. When Docker Model Runner loads the model for inference, model.py executes on the host as the logged-in user. Requires: Docker Desktop ≤ 4.70.x Apple Silicon with Model...

CVE-2019-5736

CVE-2019-5736 Reference: cve-2019-5736-poc 1. edit poc command in stage2.cve 2. build docker docker build -t cve . 3. run docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. edit...

CVE-2019-5736-POC

Breaking out of Docker via RunC A proof of concept code for CVE-2019-5736 This POC is heavily based on YuvalAvra's POC. I do not claim any credit for the code utilised in this POC. More information about this vulnerability and a demonstration of how it can be exploited can be found in the...