Docker Sandboxes allowed host Git execution through attacker-edited repository configuration

A coding agent operating inside a Docker Sandbox could write executable Git configuration into a mounted repository. Later trusted host Git operations interpreted that configuration, including core.fsmonitor, outside the sandbox.

The Docker Sandboxes advisory identifies CVE-2026-121614, affected versions from 0.31.0 until 0.50.0 and a fix in 0.50.0. The effect requires a subsequent host-side Git operation; it is not an unconditional microVM breakout.

The Git configuration survives the sandbox boundary because the trusted host later interprets it. In direct mode, an agent with repository write access can edit .git configuration, including core.fsmonitor, without escaping the microVM at that moment. A later host-side Git operation in clone mode, or sbx kit push on affected versions, may evaluate the executable setting as the human user's process. The advisory lists Docker Sandboxes from 0.31.0 until the 0.50.0 fix; sbx kit push entered the path in 0.39.0. A clone-mode read-only mount by itself cannot plant the malicious host Git setting. This is a deferred host-execution path requiring both the earlier write and later trusted Git action.

The hazardous moment comes later, when a trusted host Git command interprets configuration that an untrusted sandbox could modify. Settings such as core.fsmonitor can launch programs outside the microVM even though the original edit was confined to a repository. This is not a general direct microVM escape. It also differs from the separate sbx cp symlink bug: that one makes a host-side copy follow an unsafe path, while this one makes host tooling execute configuration supplied across the trust boundary.