Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2025-15558: Docker CLI could allow attackers to run code
CVE-2025-15558 · published 15 days ago
Summary
The Docker command‑line interface package has a flaw that could let an attacker execute unauthorized commands on the host where Docker runs. This risk is removed in the latest updated versions of the Docker CLI and related Docker components. Upgrade to the newest Docker CLI release as soon as possible to stay protected.
What to do
- Update github.com docker to version 29.2.0.
- Update github.com docker to version 5.1.0.
- Update docker github.com/docker/cli to version 29.2.0.
- Update docker github.com/docker/compose/v5 to version 5.1.0.
- Update docker-cli to version 29.2.1.
- Update docker rootio-github.com/docker/cli to version v27.1.1-root.io.2+incompatible.
- Update docker rootio-github.com/docker/cli to version v27.1.1+incompatible-root.io.2.
- Update docker github.com/docker/cli to version v27.1.1+incompatible-aikido.2.
- Update docker github.com/docker/cli to version v27.1.1-aikido.3+incompatible.
- Update docker rootio-github.com/docker/cli to version v27.1.1-root.io.3+incompatible.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | docker |
>= 19.03.0, < 29.2.0 Fix: upgrade to 29.2.0
|
| go | github.com | docker | >= 2.31.0, <= 2.40.3 |
| go | github.com | docker |
< 5.1.0 Fix: upgrade to 5.1.0
|
| Go | docker | github.com/docker/cli |
>= 19.03.0, < 29.2.0 Fix: upgrade to 29.2.0
|
| Go | docker | github.com/docker/compose/v2 | >= 2.31.0, <= 2.40.3 |
| Go | docker | github.com/docker/compose/v5 |
< 5.1.0 Fix: upgrade to 5.1.0
|
| – | docker | command_line_interface |
<= 29.1.5 cpe:2.3:a:docker:command_line_interface:*:*:*:*:*:*:*:* |
| Bitnami | – | docker-cli |
< 29.2.1 Fix: upgrade to 29.2.1
|
| Root:Go | docker | rootio-github.com/docker/cli |
< v27.1.1-root.io.2+incompatible < v27.1.1+incompatible-root.io.2 < v27.1.1-root.io.3+incompatible Fix: upgrade to v27.1.1-root.io.2+incompatible
|
| – | docker | docker cli | All versions |
| – | docker | compose | All versions |
| Root:Go | docker | github.com/docker/cli |
< v27.1.1+incompatible-aikido.2 < v27.1.1-aikido.3+incompatible Fix: upgrade to v27.1.1+incompatible-aikido.2
|
Original advisory text
CVE-2025-15558 in github.com/docker/cli - Patched by Root
Root has patched CVE-2025-15558 in the github.com/docker/cli package for Root:Go. Multiple fixed versions available.
References
- https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p
- https://nvd.nist.gov/vuln/detail/CVE-2025-15558
- https://github.com/docker/compose/pull/12300
- https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa
- https://docs.docker.com/desktop/release-notes
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304
- https://github.com/advisories/GHSA-p436-gjf2-799p
- https://github.com/docker/cli Product
- https://docs.docker.com/desktop/release-notes/ Release Notes
- https://github.com/docker/cli/pull/6713 Issue Tracking Patch
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/ Not Applicable
- https://access.redhat.com/security/cve/CVE-2025-15558
- https://bugzilla.redhat.com/show_bug.cgi?id=2444574
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-427Uncontrolled Search Path Element
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen6 Mar 2026
Sources
CVE-2025-15558 · NVD
GHSA-p436-gjf2-799p · GHSA
GHSA-p436-gjf2-799p · OSV
CVE-2025-15558 · OSV
CVE-2025-15558 · MITRE
Track software like this
Free during beta