CVE-2026-5817 Details

A vulnerability exists in the vllm-metal inference backend of Docker Model Runner on macOS. The issue arises because the backend automatically sets trust_remote_code=True when loading model tokenizers, without any sandboxing. This behavior allows transformers.AutoTokenizer.from_pretrained() to execute arbitrary Python files from models retrieved from an OCI registry. Consequently, this leads to arbitrary code execution on the Docker host, executed as the Docker Desktop user, whenever inference is performed. The vulnerability can be exploited by any container on the Docker network that calls the model-runner.docker.internal API to fetch a malicious model and request inference.