Docker Sandboxes versions before 0.50.0 allow a repository to influence host‑side Git configuration when certain host Git commands are executed. This vulnerability exploits a configuration error (CWE-15). An attacker who can alter a host repository’s Git settings, for example by modifying the configuration inside a direct‑mode sandbox that mounts the repository read‑write, can set a configuration key such as core.fsmonitor to invoke an external program. When that repository is later used in a clone‑mode sandbox or when an sbx kit push is performed (from version 0.39.0 onward), Git executes the configured program on the host with the invoking user’s permissions, which bypasses the sandbox’s microVM isolation and grants the attacker arbitrary code execution on the host machine.

The vulnerability affects Docker Sandboxes, specifically all builds from version 0.31.0 up to but not including 0.50.0. The affected product is Docker’s AI sandbox platform. The advisory recommends upgrading to version 0.50.0 or later to obtain the fix.

The CVSS score of 7.1 indicates a high severity. Exploitability is not quantified with an EPSS score, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker requires the ability to modify a host repository’s Git configuration, which can be achieved via a direct‑mode sandbox with write access. Once enabled, the attacker can execute arbitrary code on the host, potentially compromising the entire system. The lack of isolation between the sandbox and host during specific Git operations creates a clear attack path for users who allow untrusted repositories to influence host Git configuration.