EUVD-2026-56842Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector reflects prompt-injection delivery path; AC:H captures Docker Desktop plus Dev Containers CLI prerequisites; scope changed because container escapes to host filesystem.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt. This issue is fixed in version 3.0.0.
Articles & Coverage 1
AnalysisAI
Sandbox escape in Cursor IDE for macOS (versions prior to 3.0.0) allows a malicious or prompt-injected AI agent operating in Auto-Run Sandbox mode to break container isolation by invoking the Dev Containers CLI to launch a privileged Docker container that mounts the host's virtiofs0 virtual filesystem. This grants the agent unrestricted read and write access to the user's entire home directory and enables arbitrary command execution at the user's privilege level - all without any additional permission prompt to the user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four of the following conditions must be simultaneously true: (1) Cursor IDE version prior to 3.0.0 is installed on macOS; (2) Docker Desktop is installed and its daemon is running, providing access to the virtiofs0 virtual filesystem that bridges the host and container environments; (3) the Dev Containers CLI ('devcontainer' binary) is installed and reachable in the agent's execution path; and (4) a Cursor AI agent session is actively running in Auto-Run Sandbox mode, which permits the agent to execute commands without per-action user confirmation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:N/UI:P reflects high impact across confidentiality, integrity, and availability of the vulnerable system, moderated by attack-requirement prerequisites (AT:P) that must align before exploitation succeeds. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious repository file, crafted document, or web page delivers a prompt that, when processed by Cursor's AI agent in Auto-Run Sandbox mode, causes the agent to issue a 'devcontainer' CLI command spawning a privileged Docker container with the virtiofs0 device mounted. Once running, the agent reads sensitive files from the user's home directory - such as SSH private keys, shell configuration files, or browser session data - or overwrites them, or executes arbitrary shell commands on the host as the logged-in macOS user. … |
| Remediation | Upgrade Cursor IDE to version 3.0.0 or later, which is the vendor-confirmed fix per GitHub security advisory GHSA-v4xv-rqh3-w9mc at https://github.com/cursor/cursor/security/advisories/GHSA-v4xv-rqh3-w9mc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue an urgent directive requiring all macOS users of Cursor IDE to upgrade to version 3.0.0 immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today