The vulnerability arises because the MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which loads and executes Python files from model directories as specified by the model_file configuration in config.json without verifying trust or sandboxing. This lack of validation enables an attacker controlling a container on the Docker network to cause the backend to execute arbitrary Python code on the host system with the privileges of the Docker Desktop user. The attack vector involves pulling a malicious model from an attacker-controlled OCI registry and invoking inference through the model-runner.docker.internal API. The CVSS 4.0 base score is 8.8, reflecting high impact and exploitability with local attack vector but requiring some privileges.

Successful exploitation results in arbitrary code execution on the Docker host with the privileges of the Docker Desktop user, potentially leading to full compromise of the host environment. The vulnerability affects Docker Desktop 4.56.0 on macOS and allows an attacker with access to any container on the Docker network to execute malicious Python code by supplying a crafted model. This can lead to unauthorized control over the host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, restrict access to the Docker network and the model-runner.docker.internal API to trusted containers only, and avoid pulling models from untrusted OCI registries.