https://pwn.watch/i/docker-sandboxes-git-config-escape-cve-2026-121614 CVE-2026-121614 affects Docker Sandboxes 0.31.0 before 0.50.0. Host-side Git commands did not neutralize repository-controlled Git configuration. An attacker who can modify a host repository's Git config—for example through a direct-mode sandbox with the repo mounted read-write—can set core.fsmonitor or another setting that invokes an external program. A later clone-mode fetch, or from 0.39.0 an sbx kit push, can run that program on the host with the user's privileges, outside the microVM. Clone-mode's read-only host mount alone cannot poison the config. Fixed in Docker Sandboxes 0.50.0 (released Oct 26 2026; CVE published ~Nov 3). Vendor CVSS 4.0 is 7.1 (High). Upgrade to 0.50.0+; avoid read-write mounts of untrusted repos until patched. en Tue, 03 Nov 2026 00:00:00 GMT https://pwn.watch/i/docker-sandboxes-git-config-escape-cve-2026-121614 https://pwn.watch/i/docker-sandboxes-git-config-escape-cve-2026-121614#2026-11-03-fd3355f4 Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://www.rapid7.com/db/vulnerabilities/cve-2026-121614/">Source</a></p> https://pwn.watch/i/docker-sandboxes-git-config-escape-cve-2026-121614 https://pwn.watch/i/docker-sandboxes-git-config-escape-cve-2026-121614#2026-10-26-2400f754 Mon, 26 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/docker/sbx-releases/releases/tag/v0.50.0">Source</a></p>