CVE-2026-121614

Received Received - Intake

Git Configuration Injection in Docker Sandboxes

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Docker Inc.

Description

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-121614

Affected Vendors & Products

Vendor	Product	Version / Range
Docker	Docker Sandboxes	0.31.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

Docker Sandboxes versions 0.31.0 to 0.49.0 have a flaw where malicious Git configuration in a repository can escape sandbox isolation. An attacker with write access to a repository can set Git options like core.fsmonitor to run external programs during Git operations. These programs execute on the host system with the user's permissions, bypassing the sandbox's microVM protection.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your host system if they can modify a repository's Git configuration. This could lead to data theft, system compromise, or further network intrusions, depending on your user privileges.

Mitigation Strategies

Upgrade Docker Sandboxes to version 0.50.0 or later to address the vulnerability. Ensure no untrusted users or processes can modify Git configuration in host repositories, especially those mounted read-write in direct-mode sandboxes.

Hi! I’m here to help you understand CVE-2026-121614. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...