Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-121614— Docker Sandboxes host Git executes repository-controlled programs

Quick assessment

Affected

Docker Docker Sandboxes

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 0.31.0 至 0.50.0（不含）之间的 Docker Sandboxes 中，当执行某些宿主机侧的 Git 命令时，未能对由仓库控制的 Git 配置进行中和处理。如果攻击者能够修改宿主机仓库的 Git 配置（例如通过以直接模式运行并将仓库以读写方式挂载的沙箱），则可以配置或其他会调用外部程序的 Git 设置。在后续以克隆模式执行的 fetch 操作，或从 0.39.0 版本起由用户发起的 sbx kit push 操作中，Git 可能会执行该外部程序。该程序将在宿主机上以发起用户的权限运行，且位于沙

CVSS 7.1 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1059 · Command and Scripting Interpreter T1210 · Exploitation of Remote Services

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Docker Sandboxes host Git executes repository-controlled programs

Source: CVE Program / CVE List V5

Vulnerability Description

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

系统设置或配置在外部可控制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Docker	Docker Sandboxes	0.31.0 ~ 0.50.0	`cpe:2.3:a:docker:docker_sandboxes::::::::`

II. Public POCs for CVE-2026-121614

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121614

请登录查看更多情报信息。

Vendor Pages for CVE-2026-121614 (2)

🔗 Docker Sandboxes | Docker Docs product
🔗 Isolation layers | Docker Docs Read full article technical-description

Other References for CVE-2026-121614 (1)

https://github.com/docker/sbx-releases/releases/tag/v0.50.0 release-notes

https://www.cve.org/CVERecord?id=CVE-2026-121614

Same Patch Batch · Docker · 2026-11-03 · 6 CVEs total

CVE-2026-112917	9.2 CRITICAL	Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
CVE-2026-103916	8.4 HIGH	Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory
CVE-2026-93325	7.3 HIGH	Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
CVE-2026-121541	5.6 MEDIUM	Bake filesystem path entitlements approval can be skipped in some multi-target builds
CVE-2026-121542	1.8 LOW	Bake filesystem path entitlements approval can be skipped for path using basename prefix

IV. Related Vulnerabilities

Same product: Docker Sandboxes

Same vendor: Docker

Same weakness: CWE-15