Docker security announcements (Sandboxes 0.42.0; NVD received CVE-2026-77179 on 15 September 2026) document two sandbox-escape flaws. CVE-2026-77179 (Critical, Docker CVSS 4.0 base 9.4): on macOS the virtio-fs host server followed symlinks when reopening an unlinked file from a stored path, so malicious guest code (e.g. a compromised AI coding agent inside sbx) could escape the shared project workspace and read/modify arbitrary host files as the VMM user — potentially host code execution.

Affects Sandboxes 0.28.0 up to but not including 0.42.0 on macOS. Companion CVE-2026-79994 (High, CVSS 4.0 8.7): guest-to-host Unix-domain socket relay TOCTOU symlink race; affects 0.37.0 up to but not including 0.42.0.

Both fixed in 0.42.0 (release notes / sbx-releases tag). CISA's CVE-record enrichment lists exploitation as 'none', and neither CVE is in CISA's KEV catalog as of 27 October 2026. Workaround if unable to upgrade: use clone mode and avoid additional host mounts. Category vulnerabilities with AI-agent sandbox tag. (sources: Docker security announcements; NVD; GitHub sbx-releases v0.42.0)

Correction (27 Oct 2026): the affected range for CVE-2026-79994 is now given as Docker states it, 0.37.0 up to but not including 0.42.0, rather than 'through 0.41.9'; a line on exploitation status was removed because Docker's announcement does not contain it. (source: Docker security announcements; CVE.org)