High severity · published Aug 11, 2026
CVE-2026-73218
Cursor: Sandbox escape via launching privileged containers
7.7
CVSS
0.6%
EPSS
No
On KEV
Description
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt. This issue is fixed in version 3.0.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
cursor · cursor
< 3.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73218
github.com
https://github.com/cursor/cursor/security/advisories/GHSA-v4xv-rqh3-w9mc
More from cursor
9.9
CVE-2026-26268
Cursor sandbox escape via Git hooks
9.8
CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working directory
9.8
CVE-2026-50549
Cursor Desktop sandbox escape via symlink and failed path canonicalization
9.8
CVE-2026-22708
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
9.8
CVE-2025-62354
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those…