Cursor IDE CVE-2026-73218

All four of the following conditions must be simultaneously true: (1) Cursor IDE version prior to 3.0.0 is installed on macOS; (2) Docker Desktop is installed and its daemon is running, providing access to the virtiofs0 virtual filesystem that bridges the host and container environments; (3) the Dev Containers CLI ('devcontainer' binary) is installed and reachable in the agent's execution path; and (4) a Cursor AI agent session is actively running in Auto-Run Sandbox mode, which permits the agent to execute commands without per-action user confirmation. The sandbox bypass itself requires no additional user permission prompt at exploit time. Factors limiting exploitation: the vulnerability is described as macOS-specific (other Cursor platforms are not mentioned as affected); requires a live Docker daemon; requires an active agent session in Auto-Run mode; and requires delivery of a malicious prompt through the agent's context, such as via prompt injection through untrusted repository content, a crafted file opened in the editor, or a web-sourced context document. The CVSS 4.0 vector includes PR:N, indicating no authentication is required from the attacker's perspective when operating through the prompt-injection delivery path.

The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:N/UI:P reflects high impact across confidentiality, integrity, and availability of the vulnerable system, moderated by attack-requirement prerequisites (AT:P) that must align before exploitation succeeds. Real-world risk is meaningful but bounded: exploitation requires Docker Desktop and the Dev Containers CLI both be installed on the same macOS machine running a vulnerable Cursor version, with an AI agent session actively in Auto-Run Sandbox mode. The developer audience most likely to run Cursor is also the demographic most likely to have Docker Desktop installed, which tightens the gap between theoretical and practical exploitability - even a mid-sized development shop in malbork managing shared AI-assisted coding environments should treat this as an urgent upgrade rather than deferred maintenance. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, meaning confirmed widespread active exploitation is not established. EPSS data was not provided in the input, so numerical exploitation probability cannot be assessed. The potential for AI agent prompt injection as a remote trigger elevates concern beyond a purely local-privilege-escalation framing, since a malicious repository file or web page could serve as the delivery mechanism for an attacker with no local access.

A malicious repository file, crafted document, or web page delivers a prompt that, when processed by Cursor's AI agent in Auto-Run Sandbox mode, causes the agent to issue a 'devcontainer' CLI command spawning a privileged Docker container with the virtiofs0 device mounted. Once running, the agent reads sensitive files from the user's home directory - such as SSH private keys, shell configuration files, or browser session data - or overwrites them, or executes arbitrary shell commands on the host as the logged-in macOS user. No public proof-of-concept exploit has been identified at time of analysis.