CVE-2026-5817

Name of the Vulnerable Software and Affected Versions Docker Model Runner on macOS (affected versions not specified)

Description The vllm-metal inference backend unconditionally sets trust remote code=True when loading model tokenizers and operates without sandboxing. This allows the transformers.AutoTokenizer.from pretrained() function to import and execute arbitrary Python files contained within any model retrieved from an OCI registry. Consequently, this leads to arbitrary code execution on the Docker host with the privileges of the Docker Desktop user when inference is triggered. Any container on the Docker network can initiate this process by calling the 'model-runner.docker.internal' API to pull a malicious model and request inference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.