CVE-2026-5843 — Docker Desktop vulnerability

Vendor	Product	Version range	Fixed in
docker	docker_desktop	>= 4.56.0 < 4.71.0	4.71.0
docker	docker_desktop	>= 4.56.0 < 4.71.0	4.71.0

GHSA

GHSA-9m9w-53g9-47c4: The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files f

ghsa_unreviewed·2026-05-26

CVE-2026-5843 [HIGH] CWE-829 GHSA-9m9w-53g9-47c4: The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files f The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference.

VulDB

Docker Desktop up to 4.70.x MLX Inference Backend config.json model_file inclusion of functionality from untrusted control sphere

vuldb·2026-05-23

CVE-2026-5843 [CRITICAL] Docker Desktop up to 4.70.x MLX Inference Backend config.json model_file inclusion of functionality from untrusted control sphere A vulnerability, which was classified as critical, has been found in Docker Desktop up to 4.70.x. This impacts an unknown function of the file config.json of the component MLX Inference Backend. This manipulation of the argument model_file causes inclusion of functionality from untrusted control sphere. This vulnerability is registered as CVE-2026-5843. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

CVEList

Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading

cvelistv5·2026-05-22·CVSS 8.8

CVE-2026-5843 [HIGH] CWE-829 Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and

CVE-2026-5843: The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model…

Affected

CVSS provenance