PT-2026-42831 · Pypi+1 · Mlx-Lm+1

David Rochester + 1 · Published 2026-05-22 · Updated 2026-05-23 · CVE-2026-5843

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Model Runner on macOS (affected versions not specified)

Description The MLX inference backend uses the MLX-LM library, which imports and executes arbitrary Python files from model directories via the model file configuration field in the config.json file. This occurs because MLX-LM utilizes importlib to load and execute the file without a safety check or trust gate. Since the MLX backend operates without sandboxing, this leads to arbitrary code execution on the Docker host as the Docker Desktop user. An attacker can trigger this by calling the 'model-runner.docker.internal' API to pull a malicious model from a controlled OCI registry and requesting inference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-5843

Affected Products

Docker Model Runner

Mlx-Lm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5843 · Security Note
• https://docs.docker.com/desktop/release-notes/#4710 · Note
• https://twitter.com/infoflowcloud/status/2058156272889848265 · Twitter Post
• https://t.me/CVEtracker/54667 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2057915180667814357 · Twitter Post
• https://twitter.com/CVEnew/status/2058155787449770304 · Twitter Post