{"id":"CVE-2026-77179","title":"On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path","summary":"On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, an…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":["CWE-59"],"vendor":"Docker","product":"Docker Sandboxes","affected":["sandboxes >= 0.28.0 < 0.42.0"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T20:38:33.883","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77179","references":[{"url":"https://docs.docker.com/ai/sandboxes/","label":"security@docker.com"},{"url":"https://docs.docker.com/ai/sandboxes/security/isolation/","label":"security@docker.com"},{"url":"https://github.com/docker/sbx-releases/releases/tag/v0.42.0","label":"security@docker.com"},{"url":"https://github.com/docker/sbx-releases/releases/tag/v0.41.0","label":"security@docker.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-15T15:00:58.602243Z"},"cvssSource":"cna","ingestedAt":"2026-09-15T14:38:16.197Z","epss":0.0016,"epssPercentile":0.0558,"exploits":{"github":1,"githubRepos":["https://github.com/HORKimhab/CVE-2026-77179"],"checkedAt":"2026-09-21T15:30:42.361Z"},"exploitAvailable":true,"slug":"CVE-2026-77179","body":"## Overview\n\nOn macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":64,"depthScoreParts":{"impact":51.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":207758,"id":"CVE-2026-77179","ts":1789838144097,"field":"exploit_available","old":"false","new":"true"}]}