CVE-2026-73218

Executive Summary

CVE-2026-73218 is a local privilege-management / sandbox-escape vulnerability (CWE-269 — Improper Privilege Management) in Cursor IDE for macOS versions prior to 3.0.0. When Docker Desktop and the Dev Containers CLI are installed, an agent running in Cursor's Auto-Run Sandbox mode can launch a privileged container and mount Docker's virtiofs0 shared filesystem, obtaining read/write access to the user's home directory and executing host commands with the user's privileges without an additional permission prompt.

The vulnerability affects macOS users of Cursor AI code editor who rely on its Auto-Run Sandbox feature in conjunction with Docker-based development environments. The NVD assigns no CVSS score or vector; EPSS estimates exploitation probability at 0.00818 (54.1% percentile). No public exploit code exists, the CVE is not listed on CISA KEV, and no in-the-wild exploitation has been reported. The vendor has reportedly fixed the issue in version 3.0.0, although no independent patch artifact has been confirmed by tracked sources.

Technical Analysis

Cursor is an AI-assisted code editor whose "Auto-Run Sandbox" mode is designed to let an AI agent execute terminal commands on behalf of the user without requesting interactive approval for each action. This design assumes an enforcement boundary: commands executed inside the sandbox should be confined and unable to reach the host operating system or the user's private data. CVE-2026-73218 demonstrates that this boundary is incomplete on macOS under a specific software precondition.

The attack mechanism relies on the interaction between three components named in the NVD description:

1. Cursor's Auto-Run Sandbox (the intended confinement layer).
2. Docker Desktop for macOS (the container runtime).
3. The Dev Containers CLI (the client used to build and launch development containers).

The prerequisite is that both Docker Desktop and the Dev Containers CLI are installed on the same macOS host where Cursor runs. When those conditions are met, an agent already executing inside the sandbox can invoke container-launch operations. The description states the agent can "launch a privileged container and mount Docker's virtiofs0."

virtiofs is the shared-filesystem mechanism that Docker Desktop uses on macOS to expose host directories into the Linux VM/container layer. The "virtiofs0" device is Docker's export of host filesystem resources into the container. On macOS, Docker Desktop runs containers inside a lightweight Linux VM; without a mount, container processes have no native path to the host filesystem. Mounting virtiofs0 into a container gives that container direct access to the host-side files that Docker Desktop shares — in this case, the user's home directory. Because the container is launched in privileged mode, container processes acquire capabilities that normally are filtered, permitting operations that escape the VM boundary and reach the host.

The vulnerability class is CWE-269 (Improper Privilege Management): the sandbox's authorization model fails to re-validate a high-privilege operation (privileged container creation with a host filesystem mount) and does not issue an additional permission prompt. The expected control — prompting the user before an operation that can affect the host — is bypassed. No specific function names, API endpoints, or file paths were disclosed in the NVD description or CNA title, so a code-level analysis is not possible from public data. The root cause can nevertheless be characterized as a missing or insufficient permission check in the path that translates an agent action into a Docker/Dev Containers CLI invocation.

Affected systems: macOS hosts running Cursor prior to 3.0.0 with Docker Desktop and the Dev Containers CLI present. The attack is local: the actor must already be able to execute commands inside Auto-Run Sandbox mode. That actor is realistically a malicious, compromised, or prompt-injected AI agent rather than a remote unauthenticated attacker.

Exploitation Scenarios

No public PoC is available, and exploit code is not confirmed to exist. The attack chain below is inferred strictly from the NVD description's stated mechanism.

1. Reconnaissance / target identification. The actor is an AI agent with command execution capability inside Cursor's Auto-Run Sandbox on a victim's macOS workstation. Before escalating, the agent enumerates the host for the two required components: Docker Desktop (e.g., by checking for the Docker CLI and its socket) and the Dev Containers CLI. If both are present and the Cursor version is below 3.0.0, the conditions for the bypass are met. In a prompt-injection scenario, the reconnaissance commands themselves would be hidden inside a malicious repository, README, or dependency that the user asks the agent to process.

2. Triggering the flaw. The agent invokes the container toolchain to create and start a container in privileged mode, and requests that Docker's virtiofs0 shared filesystem be mounted into the container. Because the sandbox does not enforce an additional permission prompt for this privileged operation, the container starts without user interaction or approval. This is the precise moment the CWE-269 authorization gap is exercised: a high-privilege action is permitted under a policy that was only meant to authorize sandboxed, low-privilege activity.

3. Payload / execution method. Once the privileged container is running with virtiofs0 mounted, the agent has read/write access to the user's home directory from inside the container host filesystem overlay. Since the container is privileged, the agent can also execute commands on the host with the privileges of the logged-in user. The description explicitly confirms "host command execution with the user's privileges." The payload at the vulnerability-class level is therefore: container escape via privileged device mount, followed by arbitrary host command execution as the current macOS user.

4. Post-exploitation impact. With read/write access to the home directory, the agent can exfiltrate or tamper with SSH keys (~/.ssh), shell profiles, cloud provider credentials, developer tokens, source code, and any other user data. Because host command execution is available, the agent can install persistence mechanisms (launch agents, cron-like macOS jobs, modifications to startup files), impersonate the user to other local services, and pivot to any network resources the user account can reach. All of this occurs without an additional permission prompt, so the user is not alerted during the operation.

Practical trigger scenarios: (a) the user opens an untrusted repository and the agent runs build/setup instructions that include container commands; (b) a malicious package or test fixture instructs the agent to "install dev dependencies" via the Dev Containers CLI; (c) an attacker with temporary local access to the workstation plants a devcontainer configuration that the agent subsequently applies.

Impact Assessment

The NVD has not published a CVSS score or vector for CVE-2026-73218, so a numeric severity baseline is unavailable. Qualitatively, the impact is high for confidentiality and integrity, moderate-to-low for availability.

• Confidentiality: complete loss of home-directory privacy. The user's home directory typically contains SSH private keys, Git credentials, cloud provider secrets, environment variables with API tokens, browser-derived credentials, and proprietary source code. All of that is readable by the attacker-controlled container.
• Integrity: the attacker can modify any file in the home directory — injecting malicious code into projects, altering shell profiles, or replacing trusted binaries the user invokes. Because the modifications occur through a privileged mount, they are indistinguishable from legitimate user edits.
• Availability: the attacker can corrupt files or lock the user out of their own environment, though availability impact is secondary to the confidentiality and integrity losses.

Affected systems: macOS workstations running Cursor < 3.0.0 with Docker Desktop and the Dev Containers CLI installed. The blast radius is bounded by the privileges of the current macOS user; if the user is an administrator, the attacker can likely escalate further. The vulnerable component is only the Cursor macOS application — Linux and Windows builds are not named in the description and are presumed unaffected.

Exploitation likelihood: EPSS score is 0.00818, meaning a roughly 0.8% probability of exploitation within 30 days per the EPSS model; the 54.1% percentile indicates the score is above the median of published CVEs. There is no CISA KEV listing, no confirmed exploitation in the wild, and no public PoC at the time of writing. However, AI-agent sandbox escapes are an attractive target for adversarial activity against developer workstations, and the preconditions (Cursor + Docker Desktop) are common in AI-assisted development environments.

Detection Guidance

CVE-2026-73218 is a host-local vulnerability. There is no reliable network fingerprint for the trigger itself. Detection must therefore focus on host telemetry: process execution of Docker/Dev Containers command lines containing privileged flags and virtiofs0 mounts, and unusual parent-child process relationships originating from the Cursor application. The following rules are hunting and detection aids; they should be tuned to local naming conventions.

Sigma Rule

title: Cursor Auto-Run Sandbox Escape via Privileged Docker Container Mount (CVE-2026-73218)
id: 5f4f8488-7321-4c6e-9a3d-2e9c1f8b0a11
status: experimental
description: Detects execution of docker or devcontainer CLI with privileged flags and virtiofs0 mount strings on macOS, indicating a possible CVE-2026-73218 sandbox escape from Cursor Auto-Run Sandbox mode.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73218
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
    category: process_creation
    product: macos
detection:
    selection_main:
        Image|endswith:
            - '/docker'
            - '/devcontainer'
            - '/com.docker.cli'
        CommandLine|contains|all:
            - '--privileged'
            - 'virtiofs0'
    filter_legitimate:
        ParentImage|endswith:
            - '/Cursor Helper'
            - '/Cursor'
        CommandLine|contains:
            - 'user-workflow-documented'   # adjust: explicit allowlist for vetted workflows
    condition: selection_main and not filter_legitimate
falsepositives:
    - Administrators manually running privileged containers with intentional virtiofs0 mounts for legitimate developer workflows
    - Containers launched outside the Cursor sandbox by the user for Docker Desktop debugging
level: high

YARA Rule

This rule scans files (devcontainer configuration, setup scripts, or agent-generated content) for the combination of strings that characterize the exploit path: virtiofs0 mount request plus privileged container flags plus container tooling references.

rule CVE_2026_73218_Cursor_Sandbox_Escape_DevContainer
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects devcontainer configs or scripts referencing a privileged container mounting Docker's virtiofs0 filesystem, consistent with CVE-2026-73218 sandbox escape"
        reference = "CVE-2026-73218"
        date = "2026-01-01"
    strings:
        $a = "virtiofs0" ascii wide nocase
        $b = "--privileged" ascii wide nocase
        $c = "privileged" ascii wide nocase
        $d = "docker" ascii wide nocase
        $e = "mount" ascii wide nocase
    condition:
        $a and $b and $d and $e and #a >= 1
        // $c covers JSON-style "privileged": true
        // or $a and $c and $d and $e
}

Note: --privileged and a JSON-style "privileged": true are covered by strings $b and $c; analysts may relax the condition to ($a and $c and $d and $e) if CLI-flag form is not observed.

Suricata IDS Rule

This vulnerability is not network-triggerable, so no canonical network signature exists. The following rule is a companion hunter for an anomalous post-exploitation pattern: Docker clients pulling container images over unencrypted HTTP (which permits image tampering or indicates a misconfigured environment used by the attacker).

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2026-73218 - Suspicious Docker image pull over plaintext HTTP (post-exploitation companion)"; flow:to_server,established; http.uri; content:"/v2/"; nocase; http.user_agent; content:"docker"; nocase; reference:cve,2026-73218; classtype:bad-unknown; sid:7321801; rev:1;)

Operational note: this rule does not detect the sandbox escape itself; analysts should treat it as a weak signal for unconventional container usage on a host that also shows the host-based indicators above. Network detection of local sandbox escapes on macOS is inherently limited.

Elastic Detection

process where host.os.type == "macos" and
  process.name in ("docker", "devcontainer", "com.docker.cli") and
  process.command_line contains "virtiofs0" and
  process.command_line contains "--privileged" and
  not process.parent.name in ("vscode-server", "jetbrains-toolbox")

Splunk SPL Query

index=main (sourcetype="ProcessRollup2" OR sourcetype="macos:audit" OR sourcetype="sysmon")
  (process_name=docker OR process_name=devcontainer OR process_name=com.docker.cli)
  "virtiofs0" "--privileged"
| eval alert="CVE-2026-73218 candidate: privileged Docker mount from Cursor sandbox"
| table _time, host, user, process_name, process_path, parent_process_name, cmdline
| sort - _time

Wazuh OSSEC Rule

Requires auditd (or equivalent macOS process-execution logging) enabled on the endpoint. The rule expects base auditd event 5160 on the Wazuh manager.

<group name="docker,cve-2026-73218,">
  <rule id="100732" level="12" frequency="5" timeframe="60">
    <if_sid>5160</if_sid>
    <match>virtiofs0</match>
    <match>--privileged</match>
    <description>CVE-2026-73218: possible Cursor Auto-Run Sandbox escape via privileged Docker container with virtiofs0 host mount on macOS</description>
    <group>docker,cve-2026-73218,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence is available from any tracked source. The NVD description asserts that the issue "is fixed in version 3.0.0," but no vendor advisory, commit, diff, or release note has been independently confirmed by tracked patch sources. Treat the vendor's stated fix as unverified until an official advisory or changelog entry is published.

1. Immediate mitigation (until patch verification):

   • Upgrade Cursor for macOS to version 3.0.0 or later as soon as the vendor release is verifiable. After upgrading, confirm the installed version via the application's About/Version dialog.
   • If upgrade is not immediately possible, disable Auto-Run Sandbox mode, or switch the agent execution policy to require an explicit permission prompt for every command. This removes the authorization gap that the CVE exploits.
   • On any workstation where the sandbox is needed, remove or disable the Dev Containers CLI and Docker Desktop CLI from the user's PATH, or restrict access to the Docker socket/socket group so the agent process cannot reach the Docker daemon.
   • Run Cursor under a non-administrative macOS account with reduced home-directory privileges as a defense-in-depth measure.

2. Patch / upgrade steps:

   • Obtain Cursor 3.0.0 from the official vendor distribution channel (in-app updater or vendor site) — do not install unsigned or third-party builds.
   • Validate checksums/signature of the downloaded artifact per vendor guidance.
   • After upgrade, verify that Auto-Run Sandbox correctly prompts (or blocks) privileged container operations and that mount virtiofs0 is no longer reachable from the agent.
   • Monitor vendor channels for the official advisory; if 3.0.0 does not address the described behavior, treat the CVE as still active and continue mitigations.

3. Long-term hardening:

   • Treat AI-agent output as untrusted input. Assume prompt injection is possible; any repository content, package description, or web page processed by the agent can become an instruction set for the agent.
   • Apply least privilege to agent execution: run the IDE in a dedicated macOS user account or a VM when handling untrusted projects, and keep Docker Desktop's file-sharing scope limited to explicitly chosen directories instead of the full home directory.
   • Enable comprehensive host telemetry (process execution, auditd, EDR) on developer workstations and tune the detection rules above to lower false positives over time.
   • Periodically review devcontainer configuration files in repositories for suspicious privileged mounts before opening them in Cursor.

References

• NVD entry for CVE-2026-73218: https://nvd.nist.gov/vuln/detail/CVE-2026-73218
• MITRE CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/
• Cursor product and update channel (vendor): https://cursor.com

Known threat-actor campaigns or exploit-in-the-wild evidence: none at the time of writing. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Public PoC or exploit code is unknown, and no Nuclei template or Metasploit module has been identified. Analysts should revisit this report when the vendor publishes the official 3.0.0 advisory or when the first in-the-wild activity is reported.