CVE-2026-73218: 
Cursor IDE vulnerability analysis and mitigation

CVE-2026-73218 is a sandbox escape vulnerability in Cursor IDE for macOS that allows an AI agent operating in Auto-Run Sandbox mode to escape its sandbox by launching a privileged Docker container. Affected versions are all Cursor releases prior to 3.0.0; the issue is fixed in version 3.0.0. The vulnerability was published on August 11, 2026, and was originally disclosed via a GitHub Security Advisory on July 14, 2026. It carries a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Feedly).

The root cause is improper privilege management (CWE-269): Cursor's Auto-Run Sandbox mode does not sufficiently restrict an agent's ability to invoke Docker CLI commands. When Docker Desktop and the Dev Containers CLI are installed on the host, a malicious agent can issue instructions to launch a privileged container (--privileged) and mount Docker's virtiofs0 virtual filesystem, which exposes the macOS host's filesystem — including the user's home directory — to the container. Because the container runs with elevated privileges and the mount grants read/write access to host paths, the agent can execute arbitrary commands on the host with the current user's privileges, all without triggering an additional permission prompt (GitHub Advisory). The attack requires that Docker Desktop and the Dev Containers CLI be installed, and that the user interact passively with a malicious agent session (e.g., by opening a malicious project or prompt).

Successful exploitation grants an attacker read and write access to the victim's entire home directory and the ability to execute arbitrary commands on the host system with the user's privileges. This can lead to theft of sensitive files (SSH keys, credentials, source code, browser data), persistence mechanisms, and lateral movement to other systems accessible from the compromised user account. The integrity and availability of the host system are also at risk, as an attacker could modify or delete files and install malware (GitHub Advisory).

As of the available data, there is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit code has been identified. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for specific preconditions (Docker Desktop and Dev Containers CLI installed, user interaction). The EPSS score is approximately 0.82%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was credited to researcher Danus365 (GitHub Advisory).

1. Precondition check: Confirm the target is running Cursor IDE (< 3.0.0) on macOS with Docker Desktop and the Dev Containers CLI installed, and that the user has Auto-Run Sandbox mode enabled.
2. Craft malicious agent instructions: Prepare a set of AI agent instructions (e.g., embedded in a malicious repository, prompt, or project file) that instruct the Cursor agent to execute Docker commands.
3. Launch privileged container: The agent issues a command such as docker run --privileged -v /:/host <image> or specifically mounts Docker's virtiofs0 virtual filesystem to gain access to the host filesystem.
4. Mount virtiofs0: The privileged container mounts Docker's virtiofs0, which exposes the macOS host's filesystem, including the user's home directory, to the container environment.
5. Execute host commands: With read/write access to the home directory and the ability to run commands inside the privileged container, the agent (or attacker) reads sensitive files (e.g., ~/.ssh/, ~/.aws/), exfiltrates data, or establishes persistence — all without triggering an additional permission prompt to the user (GitHub Advisory).

• Process: Unexpected docker run or docker exec processes spawned by the Cursor IDE process, particularly with --privileged flags or unusual volume mounts.
• File System: Unauthorized access or modification of files in the user's home directory (~/.ssh/, ~/.aws/, ~/.config/, etc.); new or modified files in home directory with unexpected timestamps.
• Network: Outbound network connections from Docker containers to unknown external IP addresses, potentially indicating data exfiltration.
• Logs: Docker daemon logs (/var/log/docker.log or via docker events) showing privileged container launches or virtiofs0 mount activity initiated during a Cursor agent session; macOS Unified Log entries showing unexpected filesystem access by Docker processes.

Cursor has released version 3.0.0, which fixes this vulnerability; users should upgrade immediately (GitHub Advisory). As a workaround for users unable to upgrade, uninstalling Docker Desktop or the Dev Containers CLI removes the preconditions required for exploitation. Additionally, users should exercise caution when opening untrusted projects or running AI agents with Auto-Run Sandbox mode enabled, and should review agent instructions before execution.