CVE-2026-73218: 
Cursor IDE vulnerability analysis and mitigation

CVE-2026-73218 is a sandbox escape vulnerability in Cursor IDE for macOS that allows an AI agent operating in Auto-Run Sandbox mode to escape its sandbox by launching a privileged Docker container. Affected versions are all Cursor releases prior to 3.0.0; the issue is fixed in version 3.0.0. The vulnerability was published on August 11, 2026, and was originally disclosed via a GitHub Security Advisory on July 14, 2026. It carries a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is improper privilege management (CWE-269): Cursor's Auto-Run Sandbox mode does not sufficiently restrict an agent's ability to interact with the Docker daemon. When Docker Desktop and the Dev Containers CLI are installed on the host, a malicious agent can issue instructions to launch a privileged container and mount Docker's virtiofs0 virtual filesystem. This mount grants the container read and write access to the user's home directory on the macOS host, and allows arbitrary command execution at the user's privilege level — all without triggering an additional permission prompt. The attack requires the presence of Docker Desktop and the Dev Containers CLI (attack requirement: PRESENT) and passive user interaction (e.g., the user running an agent task) (GitHub Advisory).

Successful exploitation grants an attacker full read and write access to the victim's home directory and the ability to execute arbitrary commands on the host system with the user's privileges. This can lead to exfiltration of sensitive files (SSH keys, credentials, source code, tokens), persistent backdoor installation, and lateral movement to other systems accessible from the compromised user account. The technical impact is rated as total across confidentiality, integrity, and availability of the vulnerable system (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of this report. The NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable, requiring specific preconditions (Docker Desktop and Dev Containers CLI installed, user running an agent in Auto-Run Sandbox mode). The EPSS score is approximately 0.82%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Precondition check: Confirm the target macOS system has Cursor IDE (version < 3.0.0), Docker Desktop, and the Dev Containers CLI (devcontainer) installed.
2. Craft malicious agent instructions: Prepare a set of AI agent instructions (e.g., embedded in a repository, prompt injection via a file, or a malicious project) that, when executed by Cursor's agent in Auto-Run Sandbox mode, instruct the agent to invoke Docker commands.
3. Launch privileged container: The agent executes a command such as docker run --privileged -v /:/host <image> or specifically mounts Docker's virtiofs0 filesystem to gain access to the host's virtual filesystem layer.
4. Mount virtiofs0: By mounting Docker's virtiofs0, the container gains read/write access to the user's home directory on the macOS host, bypassing the sandbox boundary.
5. Execute host commands: With filesystem access established, the agent (or attacker-controlled code) reads sensitive files (e.g., ~/.ssh/, ~/.aws/credentials) or writes malicious files (e.g., backdoors, modified shell configs) and executes commands at the user's privilege level — all without triggering any additional permission prompt (GitHub Advisory).

• Process: Unexpected docker run or devcontainer CLI invocations spawned by the Cursor IDE process, particularly with --privileged flags or unusual volume mounts.
• File System: New or modified files in the user's home directory (e.g., ~/.ssh/authorized_keys, ~/.bashrc, ~/.zshrc) with unexpected timestamps; presence of unfamiliar Docker images pulled to the local daemon.
• Network: Outbound connections from Docker containers to external IPs not associated with normal development activity; unexpected data transfers from the host.
• Logs: Docker daemon logs (/var/log/docker.log or via docker events) showing privileged container launches with virtiofs0 or home directory mounts initiated during Cursor agent sessions; macOS Unified Log entries for com.docker.docker showing unusual filesystem mount activity.

Cursor has released version 3.0.0 which fixes this vulnerability; users should upgrade immediately. As a workaround prior to upgrading, users can disable Auto-Run Sandbox mode in Cursor's agent settings, uninstall the Dev Containers CLI, or ensure Docker Desktop is not running while using Cursor's AI agent features. Restricting Docker socket access and avoiding the use of privileged containers in development environments also reduces risk (GitHub Advisory).

The vulnerability was credited to researcher Danus365 and disclosed via GitHub's security advisory process. No significant vendor statements beyond the advisory or notable public researcher commentary have been identified at this time.