ZDI-CAN-33973: ZDI-26-894: Docker Sandboxes Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows local attackers to execute arbitrary code on affected installations of Docker Sandboxes. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-121614.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What access and conditions does an attacker need to exploit this issue?
The attacker must be local to the affected Docker Sandboxes installation. Exploitation also requires user interaction: the target must visit a malicious page or open a malicious file.
2
What is the potential impact if exploitation succeeds?
A successful exploit allows arbitrary code execution on the affected Docker Sandboxes installation. ZDI assigned the issue a CVSS score of 7.8.