Know What's Happening in Cybersecurity

DockerDash Exposes AI Supply Chain Weakness In Docker's Ask Gordon

A critical security flaw named DockerDash was disclosed in Docker's Ask Gordon AI assistant, allowing unverified Docker image metadata to become executable instructions. The vulnerability, identified by Noma Labs, enables remote code execution in cloud and CLI environments and data exfiltration on Docker Desktop. Attackers inject malicious LABEL fields, which Ask Gordon passes to the Model Context Protocol gateway without validation, bypassing traditional security controls. Docker patched the issue in Desktop version 4.50.0, adding URL rendering blocks and mandatory user confirmations for MCP tool calls.