Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73218Cursor: Sandbox escape via launching privileged containers

High 7.7

In plain English

A high-severity privilege mismanagement in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 49.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt. This issue is fixed in version 3.0.0.

Affected products (as reported)

Vendor	Product	Versions
cursor	cursor	< 3.0.0

Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/cursor/cursor/security/advisories/GHSA-v4xv-rqh3-w9mc x_refsource_CONFIRM