Cursor IDE EUVD-2026-56838

Exploitation requires all of the following: (1) Cursor IDE running on macOS - the vulnerability is platform-specific and Windows/Linux are not identified as affected; (2) Auto-Run Sandbox mode must be enabled - this is a specific Cursor feature for AI agent automation, not the default interactive mode; (3) a Python virtual environment (venv) must exist within the project workspace for the agent to target the Python executable; (4) the Microsoft Python VS Code extension must be installed and active in the Cursor environment; (5) passive user interaction is required - the Python extension must be triggered, which occurs naturally during development activities such as running tests, activating a Python interpreter, or opening Python files. Exploitation is limited by the combination of these conditions: macOS platform, specific sandbox mode configuration, venv presence, and extension activation - reducing realistic exposure compared to what the CVSS High score alone implies.

The official CVSS 4.0 score of 7.7 with AV:N/AC:L/AT:P/PR:N/UI:P accurately captures the conditional nature of this vulnerability. AT:P (Attack Target Presence) appropriately models that a Python virtual environment must exist in the workspace, and UI:P (Passive User Interaction) reflects that the Microsoft Python extension must be triggered - both realistic conditions for developers using Python in Cursor. High impact across confidentiality, integrity, and availability of the vulnerable system is justified given full arbitrary command execution with user privileges. However, real-world risk is tempered by the confluence of required conditions: macOS only, Auto-Run Sandbox mode enabled, venv present, and Microsoft Python extension active. No CISA KEV listing and no public POC further reduce urgency relative to the raw score. Developers actively using AI agent automation in Python projects on macOS represent a meaningful but bounded population. The AV:N rating in the official vector warrants a note: exploitation mechanics are local to the machine; the network vector applies only if an attacker can influence agent behavior via remote prompt injection (e.g., a malicious repository), which is a valid but indirect path. This is a real priority for affected users - sandbox escapes with full-privilege impact should be patched promptly - but it is not a mass-exploitation emergency.

An attacker embeds adversarial content in a repository or crafts a malicious AI response that causes Cursor's sandboxed AI agent to overwrite the project's virtual environment Python binary with a shell wrapper executing attacker-chosen commands. When the developer's Microsoft Python extension subsequently activates - triggered naturally by test execution, interpreter selection, or file open events - it invokes the wrapper outside the sandbox with the user's full macOS privileges, enabling data exfiltration, arbitrary file modification, or launch of other applications. No public POC has been identified; this scenario is constructed from the vulnerability description, CVSS vector, and exploitation conditions.