CVE-2026-73217: Cursor IDE for macOS RCE Vulnerability

CVE-2026-73217 Overview

CVE-2026-73217 affects Cursor, an AI-powered code editor, on macOS. The vulnerability allows an agent running in Auto-Run Sandbox mode to escape the sandbox by replacing a virtual environment's Python executable with a malicious wrapper. The Microsoft Python extension then invokes that wrapper outside the sandbox, granting arbitrary command execution with the user's privileges. The flaw is tracked under [CWE-693: Protection Mechanism Failure]. Cursor addressed the issue in version 3.1.2. The advisory was published on 2026-08-11 and last modified the same day.

Critical Impact
An attacker-controlled AI agent can execute arbitrary host commands, modify files outside the workspace, and launch applications with full user privileges by bypassing Cursor's Auto-Run Sandbox.

Affected Products

Cursor IDE for macOS versions prior to 3.1.2
Cursor Auto-Run Sandbox mode
Workflows relying on the Microsoft Python extension inside Cursor

Discovery Timeline

2026-08-11 - CVE-2026-73217 published to NVD
2026-08-11 - Last updated in NVD database
Version 3.1.2 - Cursor releases patched build resolving the sandbox escape

Technical Details for CVE-2026-73217

Vulnerability Analysis

Cursor's Auto-Run Sandbox mode is designed to constrain AI-driven agent actions to the current workspace. The sandbox restricts file writes and command execution to prevent an agent from affecting the host system. However, the sandbox boundary does not extend to processes launched by cooperating IDE extensions. When the Microsoft Python extension resolves the interpreter path for a workspace virtual environment, it executes that binary outside the sandbox context. An agent that writes into the virtual environment directory can therefore stage code that runs with the user's full privileges.

This is a protection mechanism failure classified as [CWE-693]. The sandbox enforces boundaries on the agent process but not on downstream consumers of workspace artifacts. The exploitation vector is network-adjacent through malicious repositories or prompts that steer the agent into modifying interpreter files.

Root Cause

The root cause is inconsistent enforcement of the sandbox boundary. Files written by the agent inside the workspace, including binaries in a .venv/bin/ directory, remain trusted by other IDE components. The Microsoft Python extension invokes the Python executable directly rather than routing execution through the sandbox. This trust asymmetry allows agent-controlled bytes to become host-executed code.

Attack Vector

An attacker delivers a crafted repository, prompt, or task that instructs the Cursor agent to overwrite the workspace's Python interpreter with a wrapper script. The wrapper preserves normal interpreter behavior while executing attacker commands on invocation. When the user or the Python extension triggers interpreter discovery, test execution, linting, or debugging, the wrapper runs outside the sandbox with the user's privileges. Payload actions can include modifying files outside the workspace, exfiltrating credentials, installing persistence, and launching arbitrary applications. See the GitHub Security Advisory GHSA-p9g2-cr55-cw9c for vendor technical details.

Detection Methods for CVE-2026-73217

Indicators of Compromise

Unexpected modifications to python, python3, or pythonX.Y binaries inside project .venv/bin/ or similar virtual environment directories
Python interpreter files that are shell scripts or wrappers rather than the expected symlinks or ELF/Mach-O binaries
Child processes spawned by Code Helper or the Microsoft Python extension host that execute shell commands unrelated to Python workloads
Outbound network connections initiated shortly after opening a workspace or selecting a Python interpreter

Detection Strategies

Monitor file integrity of virtual environment interpreter paths under user home directories on macOS endpoints
Alert on process lineage where the Python extension host invokes non-Python binaries or shells with suspicious arguments
Baseline expected Cursor and code extension host behavior and flag deviations in command execution patterns

Monitoring Recommendations

Log EDR telemetry for writes to **/.venv/bin/python* and unexpected chmod +x events on interpreter files
Track Cursor application version across the fleet and alert on hosts running versions earlier than 3.1.2
Review workspace trust prompts and agent Auto-Run activity in developer environments

How to Mitigate CVE-2026-73217

Immediate Actions Required

Upgrade Cursor for macOS to version 3.1.2 or later on every developer workstation
Disable Auto-Run Sandbox mode until the upgrade is verified across the environment
Audit existing project virtual environments for tampered python binaries or wrapper scripts
Restrict opening untrusted repositories in Cursor with agent auto-execution enabled

Patch Information

Cursor resolved CVE-2026-73217 in version 3.1.2. The fix prevents the sandbox escape path where the Microsoft Python extension invoked agent-modified interpreters outside the sandbox context. Refer to the Cursor security advisory GHSA-p9g2-cr55-cw9c for full remediation details.

Workarounds

Operate Cursor without Auto-Run enabled and require manual confirmation for agent shell and file actions
Store virtual environments outside the workspace directory the agent can write to, or mark interpreter files as immutable
Disable or unload the Microsoft Python extension in Cursor workspaces used with untrusted code until patched

bash

# Verify installed Cursor version on macOS and inspect a workspace interpreter
/Applications/Cursor.app/Contents/MacOS/Cursor --version
file ./.venv/bin/python3
shasum -a 256 ./.venv/bin/python3