CVE-2026-73217: 
Cursor IDE vulnerability analysis and mitigation

CVE-2026-73217 is a sandbox escape vulnerability in Cursor IDE for macOS that allows an AI agent operating in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper, enabling arbitrary host command execution outside the sandbox. It affects all Cursor versions prior to 3.1.2 and was published on August 11, 2026. The vulnerability was reported by researcher Danus365 and disclosed via GitHub Security Advisory GHSA-p9g2-cr55-cw9c (GitHub Advisory). It carries a CVSS v4.0 base score of 7.7 (High) (Feedly).

The root cause is classified as CWE-693 (Protection Mechanism Failure) — the Auto-Run Sandbox mode in Cursor IDE for macOS fails to adequately restrict an agent's ability to modify files within Python virtual environments (GitHub Advisory). An agent running inside the sandbox can overwrite or replace the Python executable within a virtual environment with a malicious wrapper script. When the Microsoft Python extension subsequently invokes that interpreter — a process that occurs outside the sandbox boundary — the wrapper executes arbitrary host-level commands with the privileges of the logged-in user (GitHub Advisory). This attack requires the presence of a Python virtual environment in the workspace and passive user interaction (e.g., the user triggering the Python extension), aligning with the CVSS v4.0 attack requirements of AT:P and UI:P (Feedly).

Successful exploitation allows an attacker-controlled AI agent to execute arbitrary commands on the host macOS system with the user's full privileges, bypassing the intended sandbox isolation (GitHub Advisory). This can result in high confidentiality, integrity, and availability impact to the vulnerable system, including reading sensitive files, modifying files outside the workspace, and launching arbitrary applications (Feedly). The attack is scoped to the host system (no lateral movement to adjacent systems is indicated), but the ability to run arbitrary commands with user privileges represents a significant risk of data exfiltration and persistent compromise.

As of the disclosure date, there is no evidence of in-the-wild exploitation, and the SSVC exploitation status is listed as "none" (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.31%, indicating a low probability of exploitation in the near term (Feedly). No public proof-of-concept exploit code has been identified. Exploitation is not fully automatable, as it requires passive user interaction (triggering the Microsoft Python extension) and the presence of a Python virtual environment in the workspace.

1. Setup: The attacker controls or influences an AI agent running within Cursor IDE's Auto-Run Sandbox mode on a macOS system with a Python virtual environment present in the workspace.
2. Identify virtual environment: The agent enumerates the workspace to locate a Python virtual environment directory (e.g., .venv/, env/, or venv/) and its Python executable (e.g., .venv/bin/python).
3. Replace Python executable: The agent replaces the legitimate Python executable within the virtual environment with a malicious wrapper script (e.g., a shell script that executes attacker-defined commands before optionally calling the real Python interpreter).
4. Trigger Microsoft Python extension: The attacker waits for or induces the user to trigger the Microsoft Python extension (e.g., by running a Python file, using the Python REPL, or activating the environment), which invokes the tampered interpreter outside the sandbox.
5. Achieve host code execution: The malicious wrapper executes arbitrary host commands with the user's privileges — such as exfiltrating files, modifying system configurations, or launching persistent applications — outside the sandbox restrictions (GitHub Advisory).

• File System: Unexpected modification timestamps on Python executables within virtual environment directories (e.g., .venv/bin/python, env/bin/python); Python executable replaced with a shell script or non-standard binary; presence of unexpected scripts in virtual environment bin/ directories.
• Process: Unusual child processes spawned by the Microsoft Python extension process (e.g., bash, curl, osascript, open) that are not typical Python interpreter invocations; processes launched with user privileges performing file operations outside the workspace directory.
• Logs: macOS Unified Log entries showing the Python extension invoking an unexpected interpreter path; Cursor IDE logs showing agent file write operations targeting virtual environment directories.
• Network: Unexpected outbound network connections from processes spawned by the Python extension to external IP addresses, potentially indicating data exfiltration or C2 communication.

Cursor has released version 3.1.2, which fixes this vulnerability; users should update immediately (GitHub Advisory). As a workaround prior to patching, users can disable Auto-Run Sandbox mode or avoid using Python virtual environments within Cursor workspaces when running AI agents. Additionally, users should review and restrict agent permissions and be cautious about enabling Auto-Run mode with untrusted AI agents or in sensitive development environments.

The vulnerability was reported by researcher Danus365 and disclosed through GitHub's coordinated security advisory process (GitHub Advisory). No significant broader media coverage, vendor statements beyond the advisory, or notable social media commentary has been identified at this time.