EUVD-2026-124527

Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDGSTATEHOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and...

CVE-2026-126329

Docker Sandboxes is vulnerable to a privilege escalation issue because it reuses state and configuration directories without verifying ownership. If sbx or sandboxd is executed as root while the HOME or XDG_STATE_HOME environment variables point to an attacker-controlled location, a local unprivi...

CVE-2026-126330

In Docker Sandboxes , a vulnerability exists where the daemon may silently republish a sandbox service after an operator removes an automatically assigned host-port mapping. While the daemon removes the active binding, it retains the original publication request, enabling the service to be publis...

CVE-2026-97693

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...

CVE-2026-97693

The Yuxi platform (versions 0.6.0.beta1 through 0.7.1) suffers from an isolation failure between Docker sandboxes and trusted application services. A low-privileged authenticated user can bypass sandbox boundaries to access other tenants' APIs, files, and secrets, or manipulate the unauthenticate...

EUVD-2026-116532

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write,...

PT-2026-137183

Name of the Vulnerable Software and Affected Versions Yuxi versions 0.6.0.beta1 through 0.7.0 Description Insufficient isolation between execution-capable Docker sandboxes and trusted application services allows a low-privileged authenticated user to access other tenants' sandbox APIs, files, and...

CVE-2026-121614

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write,...

CVE-2026-121614 Docker Sandboxes host Git executes repository-controlled programs

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write,...

CVE-2026-121614 Docker Sandboxes host Git executes repository-controlled programs

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write,...

CVE-2026-121614

Docker Sandboxes (versions 0.31.0 before 0.50.0) fail to neutralize repository-controlled Git configuration when executing host-side Git commands. An attacker capable of modifying a host repository's configuration—such as through a direct-mode sandbox with a read-write mount—can set configuration...

CVE-2026-103916

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

EUVD-2026-116029

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

CVE-2026-103916 Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

CVE-2026-103916

Docker Sandboxes is affected by a vulnerability in the sbx cp component where it fails to safely confine host-side paths to a shared workspace. The root cause is improper link resolution (CWE-59), allowing a malicious sandbox to create or replace a workspace symlink. This enables an attacker to t...

CVE-2026-103916 Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

PT-2026-136703

Name of the Vulnerable Software and Affected Versions Docker Sandboxes versions 0.31.0 through 0.49.0 Description Docker Sandboxes fail to neutralize repository-controlled Git configurations when executing specific host-side Git commands. An attacker capable of modifying a host repository's Git...

PT-2026-136262

Name of the Vulnerable Software and Affected Versions Docker Sandboxes versions prior to 0.51.0 Description The sbx cp command does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink, allowing it to read host files outside the...

CVE-2026-103916: Docker Docker Sandboxes: Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

CVE-2026-105570

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...