EUVD-2026-56838Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because the core exploit is a local filesystem write within the sandbox; UI:R for the Python extension trigger; S:C for sandbox escape to host; full C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications. This issue is fixed in version 3.1.2.
Articles & Coverage 1
AnalysisAI
Sandbox escape in Cursor IDE for macOS prior to version 3.1.2 allows an AI agent operating in Auto-Run Sandbox mode to replace a Python virtual environment executable with a malicious wrapper, which the Microsoft Python extension then invokes outside the sandbox boundary - granting arbitrary host command execution with the user's full macOS privileges, including modifying files outside the workspace and launching applications. The vulnerability exploits a privileged trust relationship between the sandboxed agent and an unsandboxed host-level extension. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Cursor IDE running on macOS - the vulnerability is platform-specific and Windows/Linux are not identified as affected; (2) Auto-Run Sandbox mode must be enabled - this is a specific Cursor feature for AI agent automation, not the default interactive mode; (3) a Python virtual environment (venv) must exist within the project workspace for the agent to target the Python executable; (4) the Microsoft Python VS Code extension must be installed and active in the Cursor environment; (5) passive user interaction is required - the Python extension must be triggered, which occurs naturally during development activities such as running tests, activating a Python interpreter, or opening Python files. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 score of 7.7 with AV:N/AC:L/AT:P/PR:N/UI:P accurately captures the conditional nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker embeds adversarial content in a repository or crafts a malicious AI response that causes Cursor's sandboxed AI agent to overwrite the project's virtual environment Python binary with a shell wrapper executing attacker-chosen commands. When the developer's Microsoft Python extension subsequently activates - triggered naturally by test execution, interpreter selection, or file open events - it invokes the wrapper outside the sandbox with the user's full macOS privileges, enabling data exfiltration, arbitrary file modification, or launch of other applications. … |
| Remediation | Upgrade Cursor IDE to version 3.1.2 or later, which contains the vendor-released fix for this sandbox escape, as confirmed by GitHub Security Advisory GHSA-p9g2-cr55-cw9c (https://github.com/cursor/cursor/security/advisories/GHSA-p9g2-cr55-cw9c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cursor IDE installations on macOS and identify instances running versions prior to 3.1.2, prioritizing users with elevated access or responsibility for sensitive systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today