ZDI-26-894: Docker Sandboxes Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows local attackers to execute arbitrary code on affected installations of Docker Sandboxes. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-121614.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must have local access to an affected Docker Sandboxes installation. Exploitation also requires the target to visit a malicious page or open a malicious file.
2
What is the potential impact of successful exploitation?
A successful exploit allows arbitrary code execution on the affected installation. ZDI assigned the issue a CVSS rating of 7.8.