CVE-2023-0628

Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.

Score

CVSS 3.1 7.8 High

Status

Modified - security@docker.com

Published

2023-03-13

Last modified

2025-02-27

Weaknesses

CWE-77

Affected products

• Docker Desktop (Docker)
• Docker Desktop (Docker Inc.)

References

• https://docs.docker.com/desktop/release-notes/#4170