---
title: Docker Sandboxes flaw let an agent inside the sandbox plant a symlink so the user's next 'sbx cp' read or overwrote host files (CVE-2026-103916); fixed in 0.51.0 | ctxsec
url: https://ctxsec.com/items/docker-sandboxes-sbx-cp-symlink-escape-cve-2026-103916-0-51-0
description: "Docker Sandboxes isolates AI coding agents in a workspace, but its copy command (sbx cp) didn't confine host-side paths. An agent (for example, one steered by prompt injection) could create or swap a symlink in the shared workspace so a later user-run copy read a host file outside the workspace, such as cloud credentials, into the sandbox, or wrote sandbox-controlled data to a host path with the user's permissions. Rated High (CVSS 4.0 8.4 on GHSA). Endor Labs reported it; Docker's fix slipped from 0.48.0 and shipped in 0.51.0 on Nov 3."
status: "official (GitHub advisory GHSA-82h2-77xp-45m9 and Endor Labs disclosure, Nov 3)"
published: 2026-11-03
---

> Docker Sandboxes isolates AI coding agents in a workspace, but its copy command (sbx cp) didn't confine host-side paths. An agent (for example, one steered by prompt injection) could create or swap a symlink in the shared workspace so a later user-run copy read a host file outside the workspace, such as cloud credentials, into the sandbox, or wrote sandbox-controlled data to a host path with the user's permissions. Rated High (CVSS 4.0 8.4 on GHSA). Endor Labs reported it; Docker's fix slipped from 0.48.0 and shipped in 0.51.0 on Nov 3.

[← Context & Harness Attacks](/context) · [markdown](/items/docker-sandboxes-sbx-cp-symlink-escape-cve-2026-103916-0-51-0.md)

official (GitHub advisory GHSA-82h2-77xp-45m9 and Endor Labs disclosure, Nov 3)

2026-11-03

### Docker Sandboxes flaw let an agent inside the sandbox plant a symlink so the user's next 'sbx cp' read or overwrote host files (CVE-2026-103916); fixed in 0.51.0

**What to do:** update the `sbx` CLI to 0.51.0 or later. More generally, treat anything an agent leaves in a shared folder as untrusted: check for symlinks before copying out of a sandbox, and keep credentials out of directories a sandboxed agent's output can be copied toward.

Sources: [GitHub Advisory: Docker Sandboxes sbx cp does not safely confine host-side paths (CVE-2026-103916)](https://github.com/advisories/GHSA-82h2-77xp-45m9) · [Endor Labs: Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (Nov 3)](https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916)