CVE-2026-73218 Overview
CVE-2026-73218 is a privilege escalation vulnerability in the Cursor IDE for macOS. The flaw affects versions prior to 3.0.0 and allows an AI agent running in Auto-Run Sandbox mode to escape its sandbox. When Docker Desktop and the Dev Containers CLI are installed, the agent can launch a privileged container and mount Docker's virtiofs0 filesystem. This grants read and write access to the user's home directory and enables host command execution with the user's privileges. No additional permission prompt is presented to the user. The issue is tracked as [CWE-269: Improper Privilege Management] and is fixed in version 3.0.0.
Critical Impact
An AI agent operating in the sandboxed Auto-Run mode can execute arbitrary commands on the host, read sensitive files in the user's home directory, and modify files without user consent.
Affected Products
- Cursor IDE for macOS versions prior to 3.0.0
- Environments where Docker Desktop is installed alongside Cursor
- Environments where the Dev Containers CLI is installed alongside Cursor
Discovery Timeline
- 2026-08-11 - CVE-2026-73218 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-73218
Vulnerability Analysis
Cursor's Auto-Run Sandbox mode is designed to constrain AI agent actions and require user prompts before privileged operations. The sandbox does not, however, restrict access to installed local tooling such as Docker Desktop and the Dev Containers CLI. An agent operating inside the sandbox can invoke these tools and provision a container with elevated privileges. Because the container runtime executes with the user's Docker permissions, the sandbox boundary is effectively bypassed.
The vulnerability is classified under [CWE-269] Improper Privilege Management. Successful exploitation results in full read and write access to the host user's home directory and the ability to execute commands with the user's privileges. This occurs without the additional confirmation prompt the sandbox is expected to enforce for host-level actions.
Root Cause
The sandbox policy in Cursor prior to 3.0.0 fails to intercept or gate agent-initiated invocations of Docker Desktop and the Dev Containers CLI. Mounting virtiofs0, the shared virtiofs filesystem Docker Desktop uses to expose host paths into virtual machines, exposes host storage directly to a container the agent controls. The sandbox trusts local developer tooling instead of mediating its use.
Attack Vector
An attacker delivers instructions to the Cursor agent, for example through a poisoned repository, a malicious prompt, or indirect prompt injection embedded in code the agent processes. The agent, running in Auto-Run Sandbox mode, launches a privileged Docker container using the Dev Containers CLI and mounts virtiofs0. From inside that container the agent reads or writes files under the user's home directory and executes commands on the host with the invoking user's privileges. Refer to the GitHub Security Advisory GHSA-v4xv-rqh3-w9mc for technical details.
Detection Methods for CVE-2026-73218
Indicators of Compromise
- Unexpected docker run or devcontainer process invocations spawned as child processes of the Cursor IDE application.
- Container instances configured with --privileged or mounting virtiofs0 originating from developer endpoints.
- New or modified files in the user's home directory whose write time correlates with Cursor agent activity.
- Outbound network connections initiated from short-lived containers launched during coding sessions.
Detection Strategies
- Audit endpoint process trees for Cursor child processes that invoke Docker or Dev Containers CLI binaries.
- Enable Docker daemon audit logging and alert on containers created with privileged flags or virtiofs mounts.
- Correlate Cursor session logs with filesystem modification events in $HOME to identify agent-driven writes.
Monitoring Recommendations
- Track installed Cursor versions across macOS fleets and flag any host running a version below 3.0.0.
- Monitor for the co-installation of Docker Desktop and the Dev Containers CLI on developer endpoints running Cursor.
- Alert on shell command execution chains that trace from the Cursor process to interactive shells or credential files.
How to Mitigate CVE-2026-73218
Immediate Actions Required
- Upgrade Cursor IDE for macOS to version 3.0.0 or later on all developer endpoints.
- Inventory macOS systems that run Cursor together with Docker Desktop and the Dev Containers CLI and prioritize their remediation.
- Disable Auto-Run Sandbox mode on any Cursor instance that cannot be upgraded immediately.
Patch Information
Cursor version 3.0.0 remediates the sandbox escape. Details are documented in the GitHub Security Advisory GHSA-v4xv-rqh3-w9mc. Users should download the latest release from the official Cursor distribution channels and verify the installed version after upgrade.
Workarounds
- Uninstall or disable Docker Desktop on developer endpoints where the Cursor upgrade cannot be applied.
- Remove the Dev Containers CLI until Cursor is upgraded to 3.0.0 or later.
- Restrict the user account running Cursor from membership in the local docker group to prevent privileged container creation.
- Require explicit user confirmation for all agent-initiated shell commands by disabling Auto-Run features.
# Verify the installed Cursor version on macOS
/Applications/Cursor.app/Contents/MacOS/Cursor --version
# Remove the current user from the docker group as a temporary control
sudo dseditgroup -o edit -d "$USER" -t user docker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
