Evidence · DiggingBeagle record
Advisory: Docker Sandboxes lets attacker modified Git configuration execute on later trusted host Git operations
A coding agent operating inside a Docker Sandbox could write executable Git configuration into a mounted repository. Later trusted host Git operations interpreted that configuration, including core.fsmonitor, outside the sandbox. The Docker Sandboxes advisory identifies CVE-2026-121614, affected versions from 0.31.0 until 0.50.0 and a fix in 0.50.0. The effect requires a subsequent host-side Git operation; it is not an unconditional microVM breakout. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
A coding agent operating inside a Docker Sandbox could write executable Git configuration into a mounted repository. Later trusted host Git operations interpreted that configuration, including core.fsmonitor, outside the sandbox. The Docker Sandboxes advisory identifies CVE-2026-121614, affected versions from 0.31.0 until 0.50.0 and a fix in 0.50.0. The effect requires a subsequent host-side Git operation; it is not an unconditional microVM breakout. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsDocker Sandboxes allowed host Git execution through attacker-edited repository configuration: The Docker Sandboxes advisory identifies CVE-2026-121614, affected versions from 0.31.0 until 0.50.0 and a fix in 0.50.0. The effect requires a subsequent host-side Git operation; it is not an unconditional microVM breakout.
GHSA-vv2q-qr3q-w59x; Git configuration attack and fixed version
- supportsDocker Sandboxes allowed host Git execution through attacker-edited repository configuration: A coding agent operating inside a Docker Sandbox could write executable Git configuration into a mounted repository. Later trusted host Git operations interpreted that configuration, including core.fsmonitor, outside the sandbox.
GHSA-vv2q-qr3q-w59x; Git configuration attack and fixed version