CVE-2026-126329 · Other
NO FIX YET
Docker Sandboxes reuses state and configuration directories without checking who owns them. If sbx or sandboxd runs as root with HOME or XDG_STATE_HOME pointing to an attacker-controlled path, a local unprivileged user can swap in control sockets and config that the root process trusts, potentially running commands as root.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure needs a privileged invocation of sbx or sandboxd as root with HOME or, on Linux, XDG_STATE_HOME set to a location a local user controls. Installations that only run sbx as a normal user, or that never set these variables from an untrusted environment, are not in the described path. The issue affects Linux and macOS.
Not affected if default-environment, single-user-machine, unprivileged-only-use
Who cares docker-sandboxes, linux, macos, sandboxd, sbx
sbx --version and compare it to 0.53.0.sbx or sandboxd running as root and check whether HOME or XDG_STATE_HOME in its environment points to a path that unprivileged users can write to.Unknown from the sources.
Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.