By vendor

Mobyproject vulnerabilities

Known CVEs affecting Mobyproject products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-42306HIGH 7.2

  A race condition in Moby and Docker Engine allows a container to intercept and redirect bind mount operations to unintended host filesystem locations. A malicious or compromised container could exploit this timing window during the `docker cp` mount setup phase to write files to arbitrary paths on the host, potentially overwriting critical files or disrupting services. The vulnerability requires local access and user interaction, but poses significant risk in multi-tenant environments where untrusted containers run alongside sensitive workloads.

• CVE-2026-41568MEDIUM 6.1

  A race condition vulnerability in Docker Engine and Moby allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem during the docker cp operation. An attacker with container access can exploit a timing window in mount setup to place files outside intended boundaries, potentially disrupting host operations or creating persistent artifacts. The vulnerability requires local access and user interaction, limiting but not eliminating real-world risk in multi-tenant or supply-chain scenarios.