Cursor EUVD-2026-39537

Exploitation requires the victim to be running Cursor prior to 3.0 with agent terminal command execution in its default sandbox mode (the sandbox that grants write access to the command's working directory). The concrete prerequisite is that the agent be induced to set the working_directory parameter to a sensitive location outside the workspace - i.e., the agent must be malicious or manipulated (e.g., via injected/untrusted prompt or repository content). The vendor states no user interaction is needed beyond a benign prompt, meaning the only human action is normally invoking the agent; what limits exploitation is that an attacker must influence the agent's instructions or content, the victim must be on a pre-3.0 build with the sandbox enabled, and the impact runs under the user's existing privileges rather than escalating beyond them.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) yields 9.3 and models full unauthenticated network-reachable compromise with high impact - consistent with the described arbitrary file write and resulting RCE under the user's privileges. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not yet evidence of active or widespread exploitation; EPSS and SSVC data were not provided in the input. A nuance worth flagging: the vector states UI:N, yet the description says exploitation requires the user to issue a 'benign prompt' to the agent and that the agent be malicious/manipulated - so realistically a human triggers the agent run, even if unwittingly, which argues for a user-interaction or attack-requirement caveat. Net assessment: a genuinely high-priority issue for any developer running Cursor with agent mode and sandbox defaults, driven by severity and product popularity rather than confirmed in-the-wild use.

A developer uses Cursor's agent on an attacker-influenced repository or follows an attacker-supplied prompt; the agent issues a terminal command whose working_directory is set to a sensitive path outside the workspace. The sandbox then permits writing there, and the agent overwrites the cursorsandbox helper so the next command runs unsandboxed with the user's privileges, achieving full RCE. No public exploit code is identified at time of analysis, and the network attack vector with low complexity makes the chain straightforward once the agent processes malicious instructions.