Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0.
Avoid running sbx or sandboxd as root. If a privileged invocation is required, use HOME and XDG_STATE_HOME values belonging to the target account and ensure its state and configuration directories are not controlled by another user.
Upgrade Docker Sandboxes to version 0.53.0 or later.