RCE

Two container-to-host RCE vulnerabilities in Docker. vllm-metal hardcoded trust_remote_code=True, letting a malicious model execute arbitrary Python on the host. When Docker quietly patched it, we found mlx-lm doing the same thing through an importlib path with no gate at all....