Docker Patches Critical Ask Gordon AI Vulnerability Allowing Code Execution

Cybersecurity researchers revealed a serious flaw in Docker’s Ask Gordon AI assistant, which is integrated into Docker Desktop and the Command-Line Interface (CLI). The vulnerability, identified as DockerDash, allows attackers to execute code and exfiltrate sensitive data by embedding malicious instructions in Docker image metadata. This issue was patched in version 4.50.0, released in November 2025.

The attack exploits the way Ask Gordon interprets metadata, treating it as executable commands without proper validation. This flaw enables a three-stage attack where malicious metadata can compromise the Docker environment. The vulnerability was characterized as a case of Meta-Context Injection, where the Model Context Protocol (MCP) Gateway fails to distinguish between safe metadata and harmful instructions.

In a potential attack scenario, a threat actor could craft a Docker image with malicious LABEL instructions. When a victim queries Ask Gordon about this image, the AI assistant reads the metadata and forwards the instructions to the MCP Gateway, which executes them without additional validation. This could lead to remote code execution or data exfiltration, capturing sensitive information about the victim’s environment.

The vulnerability highlights the importance of treating AI Supply Chain Risk as a significant threat. It demonstrates how trusted input sources can be manipulated to execute harmful commands, emphasizing the need for zero-trust validation on contextual data provided to AI models.

Understanding the Risks

Organizations using Docker should be aware of the implications of the DockerDash vulnerability. The flaw allows for the potential hijacking of the AI’s reasoning process, leading to unauthorized command execution with the victim’s privileges. This could result in severe data breaches and operational disruptions.

Users should monitor their Docker environments for any suspicious activity, especially if they are utilizing Ask Gordon. The ability of the AI to process unverified metadata as executable commands poses a significant risk that could be exploited by malicious actors.

• Docker: The platform affected by the critical vulnerability in its Ask Gordon AI assistant.
• Noma Labs: The cybersecurity company that discovered the DockerDash vulnerability.
• Model Context Protocol (MCP): The middleware layer involved in the execution of commands from Ask Gordon.
• Version 4.50.0: The Docker release that patched the vulnerability in November 2025.
• Meta-Context Injection: The type of attack that exploits the flaw in how Ask Gordon processes metadata.