CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments
Attackers can escape the Cursor IDE sandbox by tampering with Python virtual environments, enabling arbitrary host command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-73217?
CVE-2026-73217 is a high-severity vulnerability in cursor, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications. This issue is fixed in version 3.1.2.
Weakness: CWE-693
Which versions are affected by CVE-2026-73217?
How do I fix CVE-2026-73217?
No fix has been published for CVE-2026-73217 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73217 being exploited?
There is no known exploitation of CVE-2026-73217 in the wild and no public exploit code.