High severity · published Aug 11, 2026
CVE-2026-73217
Cursor: Sandbox escape via tampered Python virtual environments
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications. This issue is fixed in version 3.1.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
cursor · cursor
< 3.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73217
github.com
https://github.com/cursor/cursor/security/advisories/GHSA-p9g2-cr55-cw9c
More from cursor
9.9
CVE-2026-26268
Cursor sandbox escape via Git hooks
9.8
CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working directory
9.8
CVE-2026-50549
Cursor Desktop sandbox escape via symlink and failed path canonicalization
9.8
CVE-2026-22708
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
9.8
CVE-2025-62354
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those…