High severity · published Jul 15, 2026
CVE-2026-61613
Cursor: Cloud Agent Browser Sandbox Escape
7.7
CVSS
0.7%
EPSS
No
On KEV
Description
Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker-controlled web content to connect from inside the agent container to an unauthenticated local agent endpoint, enabling code execution within the affected Cloud Agent sandbox or session and access to files, repository contents, environment variables, credentials, and GitHub App access tokens available to that session. This issue was fixed on 03/31/2026 by requiring authentication for the relevant agent endpoint.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
cursor · cursor
< 03/31/2026 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61613
github.com
https://github.com/cursor/cursor/security/advisories/GHSA-whx2-4gvm-m3r3
More from cursor
9.9
CVE-2026-26268
Cursor sandbox escape via Git hooks
9.8
CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working directory
9.8
CVE-2026-50549
Cursor Desktop sandbox escape via symlink and failed path canonicalization
9.8
CVE-2026-22708
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
9.8
CVE-2025-62354
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those…