Docker Sandboxes CVE-2026-77179 Allows virtio-fs Symlink Escape to macOS Host Files

The flaw stems from the virtio-fs host server reopening stored paths without validating against symlink substitution after a guest removes and replaces a parent directory. This grants the guest the privileges of the host account running the virtual machine monitor, bypassing the intended workspace boundary. A second issue, CVE-2026-79994, permits a similar TOCTOU race in the Unix domain socket relay for versions 0.37.0 to 0.41.9. Both were addressed in release 0.42.0 shipped September 7, with public disclosure eight days later.

No independent exploitation evidence exists; CISA records list exploitation as none for both CVEs and neither appears in the Known Exploited Vulnerabilities catalog. Docker states the sandbox relies on the hypervisor boundary rather than in-guest controls, yet the escape occurs entirely on the host side of file sharing. The advisory notes macOS specificity for the critical flaw while leaving platform unspecified for the high-severity relay issue, despite Sandboxes supporting Windows and Linux hosts.

The pattern mirrors prior path-handling races in shared filesystem layers. Docker's March documentation claimed symlinks outside the workspace would not be followed, yet the implementation failed to enforce this at the host server. For AI coding agents that install packages and execute with sudo inside the VM, the escape surface expands beyond the shared project directory to the entire host filesystem accessible by the VMM account.

Workarounds include switching to clone mode on Git repositories, which mounts source read-only, and avoiding additional read-write host mounts. Organizations should audit existing sandboxes for --clone usage and prioritize 0.42.0 or later deployment before agents handle sensitive codebases.