Threats tagged 'ghsa-q3q4-c92f-m955'

CVE-2026-18171 is a medium severity vulnerability in Docker Sandboxes (sbx) where the read-only intent of a runtime host mount is only applied to the in-guest container bind. The underlying virtio-fs host-edge grant remains writable at the shared-export path, allowing unprivileged code inside the sandbox to write to a host directory that was intended to be read-only.