Arbitrary Code Execution in Docker Model Runner on macOS

CVE-2026-5817

What is CVE-2026-5817?

The vllm-metal inference backend in Docker Model Runner on macOS is vulnerable due to its unconditional setting of trust_remote_code=True when loading model tokenizers. This design flaw allows for the execution of arbitrary Python files from any model obtained via OCI registry. As a consequence, when inference is triggered, it can lead to arbitrary code execution on the host system under the Docker Desktop user account. Additionally, any container on the Docker network is capable of exploiting this vulnerability by invoking the model-runner.docker.internal API to pull an affected model and request inference, further complicating the security landscape.

References