On macOS, Docker Sandboxes virtio-fs host server follows symlinks when reopening an unlinked file via a stored path, letting a malicious guest swap a parent dir with a symlink to escape the shared workspace. This enables arbitrary host file read/modify as the VMM user and may lead to host code execution. Affected: `Docker Sandboxes >=0.28.0