The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library that unconditionally imports and executes Python files from model directories as specified by the model_file field in config.json. There is no trust_remote_code gate or equivalent safety mechanism, and the MLX backend runs without sandboxing. Consequently, any container on the Docker network can exploit this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and execute arbitrary code on the Docker host with the privileges of the Docker Desktop user.

Successful exploitation results in arbitrary code execution on the Docker host with the privileges of the Docker Desktop user. This can lead to full compromise of the host environment where Docker Desktop is running. The vulnerability requires local network access to the Docker network and the ability to interact with the model-runner.docker.internal API. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the Docker network and the model-runner.docker.internal API to trusted users and containers only. Monitor vendor communications for updates on remediation.