Allegro ed32487cbe security: block dangerous Docker volume mounts (V-012, CVSS 8.7) ...

Prevent privilege escalation via Docker socket mount.

Changes:
- tools/environments/docker.py: Add _is_dangerous_volume() validation
- Block docker.sock, /proc, /sys, /dev, root fs mounts
- Log security error when dangerous volume detected

Fixes container escape vulnerability where user-configured volumes
could mount Docker socket for host compromise.

CVSS: 8.7 (High)
Refs: V-012 in SECURITY_AUDIT_REPORT.md
CWE-250: Execution with Unnecessary Privileges

2026-03-30 23:55:45 +00:00

22 KiB

Raw Permalink Blame History

View Raw