CVE-2026-73217

Executive Summary

CVE-2026-73217 is a sandbox escape vulnerability in Cursor IDE for macOS (versions prior to 3.1.2): an agent running in Auto-Run Sandbox mode can replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges. Affected hosts are macOS developer workstations running Cursor < 3.1.2 with Auto-Run Sandbox and the Microsoft Python extension enabled; successful exploitation yields user-level arbitrary code execution, file modification outside the workspace, and the ability to launch applications. The NVD description states the issue is fixed in 3.1.2, but patch confidence remains 0/4 in tracked sources, so organizations should verify the vendor release and treat the sandbox as compromised until proven patched.

Technical Analysis

The root cause of CVE-2026-73217 is a protection mechanism failure (CWE-693): the Auto-Run Sandbox, a security control intended to confine AI agent actions to a predefined workspace, fails to protect the integrity of the Python interpreter it manages. According to the NVD description, an agent executing inside Auto-Run Sandbox mode can replace a virtual environment's Python executable with a malicious wrapper. The sandbox either permits writes to the venv interpreter path or fails to block their effects; the key flaw is that the modified interpreter is later invoked outside the sandbox boundary.

The "confused deputy" element of this vulnerability is the Microsoft Python extension. The extension resolves the workspace's virtual environment interpreter through normal host process-creation mechanisms rather than through the sandbox. It therefore executes whatever content now resides at the venv Python path — including an attacker-controlled wrapper script — with the full privileges of the logged-in macOS user. No additional privilege boundary is applied between the extension's interpreter launch and the host's process execution, so commands issued by the wrapper bypass the sandbox entirely.

The attack surface is local and macOS-specific. Exploitation requires: (a) Cursor IDE prior to 3.1.2, (b) Auto-Run Sandbox mode enabled, (c) the Microsoft Python extension active, and (d) a Python virtual environment within the workspace that the agent is able to modify. The impact is bounded by the invoking user's account privileges: the NVD description explicitly lists modifying files outside the workspace and launching applications as consequences. No network exposure is required for the core exploit, although post-exploitation activity (e.g., downloading a second stage or exfiltrating files) may generate network telemetry.

The NVD description does not disclose specific function names, class names, file paths, or API endpoints involved. Insufficient technical detail is available to describe the internal implementation of the sandbox policy or the extension's interpreter-resolution logic; the analysis above is derived strictly from the vulnerability class and the behavior described. The underlying pattern is a classic interpreter-tampering / trust-boundary bypass in an agentic development environment.

Exploitation Scenarios

No public PoC is available for CVE-2026-73217; the attack chain below is inferred from the vulnerability class and the NVD description, not from observed exploit code.

1. Reconnaissance / target identification. The actor must be able to influence an agent that executes within Cursor's Auto-Run Sandbox. Realistic avenues include an untrusted workspace or repository whose instructions are processed by the agent, a prompt-injection vector, or a maliciously configured agent tool. The target is a macOS host running Cursor < 3.1.2 with Auto-Run Sandbox enabled and a Python virtual environment present in the workspace. This stage is largely opportunistic: the user operates Cursor normally, and the malicious content arrives via the project or task supplied to the agent.

2. Triggering the flaw. While confined to the Auto-Run Sandbox, the agent locates the workspace's virtual environment and replaces the Python executable with a wrapper script. The sandbox fails to prevent this modification — the core CWE-693 protection mechanism failure. This step requires no special OS privileges, only the agent's existing write access within the workspace and its ability to act on attacker-influenced instructions.

3. Payload / execution method. At the vulnerability-class level, the payload is a wrapper script that masquerades as the venv Python interpreter. When the Microsoft Python extension next invokes the interpreter (e.g., for code intelligence, debugging, or task execution), it launches the wrapper outside the sandbox. The wrapper executes arbitrary host commands with the user's privileges. Because the NVD description does not disclose wrapper construction details, detection rules should look for script content replacing native interpreter binaries (see Detection Guidance).

4. Post-exploitation impact. The NVD description explicitly enumerates capability outcomes: arbitrary host commands with the user's privileges, modifying files outside the workspace, and launching applications. This translates to full user-level access on the affected macOS host: source code and configuration outside the workspace can be read or tampered with, applications can be launched to stage further abuse, and persistence mechanisms can be installed. The compromise does not yield root or kernel privileges, but it completely defeats the purpose of the Auto-Run Sandbox, which is the trust boundary organizations rely on when delegating actions to AI agents.

Impact Assessment

Business impact is high for developer organizations using AI-assisted coding tools. Cursor IDE is positioned specifically for agentic development; the Auto-Run Sandbox is the control that makes unattended agent execution acceptable. CVE-2026-73217 nullifies that control on macOS, meaning a malicious or compromised agent gains the same host-level capabilities as the developer. Developer workstations are high-value assets: they typically hold proprietary source code, CI/CD credentials, cloud tokens, and SSH keys. The NVD description's explicit mention of file modification outside the workspace implies data integrity and confidentiality losses across the user's accessible file set.

Affected systems: macOS hosts running Cursor < 3.1.2 with the Microsoft Python extension in use and Auto-Run Sandbox mode enabled. Windows and Linux are not implicated by the description. Attack complexity is moderate — the actor must influence the agent's actions — and no authentication is required beyond the established user session. The confidentiality, integrity, and availability of user data are all at risk.

CVSS Score: N/A (no vector assigned by the vendor or CNA). EPSS is 0.00312 (23.9th percentile of exploited CVEs), indicating low near-term in-the-wild exploitation likelihood per current data. CISA KEV: no. However, probability metrics should not drive risk decisions here: the vulnerability defeats a security control, and its exploitation is silent from a network perspective. Detection and monitoring are therefore the primary defensive levers.

Detection Guidance

Detection should target three observable layers: (1) modification of Python interpreter files inside virtual environments, (2) execution of venv interpreter paths whose on-disk content is a script rather than a native Mach-O binary, and (3) post-exploitation behavior such as interactive shell spawns, outbound downloads, or file writes outside the workspace. The rules below are heuristic — they assume standard Python venv layout (e.g., .venv/bin/python, venv/bin/python3), which is ecosystem convention rather than a CVE-specific disclosed path. Tune thresholds and path lists to your environment.

Sigma Rule

title: CVE-2026-73217 — Cursor Sandbox Escape via Python Interpreter Replacement
id: 8f3a5f74-2c11-4c9a-9d5b-7a1c9e2b4d01
status: experimental
description: Detects execution of a Python interpreter from a virtual environment with inline command arguments, consistent with a wrapper script masquerading as the interpreter (Cursor Auto-Run Sandbox escape, CVE-2026-73217).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73217
tags:
  - attack.t1068
  - cve.2026-73217
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/.venv/bin/python'
      - '/.venv/bin/python3'
      - '/venv/bin/python'
      - '/venv/bin/python3'
    CommandLine|contains:
      - '-c'
      - 'subprocess'
      - 'os.system'
  filter:
    ParentImage|endswith:
      - '/bin/bash'
      - '/bin/zsh'
      - '/usr/bin/make'
      - '/usr/bin/python3'
  condition: selection and not filter
falsepositives:
  - Developer tooling that intentionally invokes venv Python inline (e.g., build scripts, pytest wrappers)
level: high

YARA Rule

/*
   CVE-2026-73217 — detects wrapper scripts masquerading as venv Python interpreters on macOS.
   Target: Python virtual environment directories (e.g., .venv/bin/python, venv/bin/python3).
   A legitimate interpreter is a native Mach-O binary; a wrapper is a script with a shell shebang.
*/
rule CVE_2026_73217_Python_Wrapper_Masquerade
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Wrapper script masquerading as a virtualenv Python interpreter (Cursor Auto-Run Sandbox escape, CVE-2026-73217)"
        cve = "CVE-2026-73217"
        os = "macos"
    strings:
        $sh1 = /^#!\/bin\/(ba|z)?sh/
        $sh2 = /^#!\/usr\/bin\/env (ba|z)?sh/
        $exec = "exec" ascii nocase
        $download = /(curl|wget|osascript|open|nc )/ ascii nocase
        $self_ref = /#!.*python/ ascii
    condition:
        filesize < 100KB and
        ($sh1 at 0 or $sh2 at 0) and
        not $self_ref and
        any of ($exec, $download) and
        ( filename matches /(^|\/)\.?venv\/bin\/python3?$/ )
}

Suricata IDS Rule

CVE-2026-73217 is a local vulnerability; the core attack generates no network traffic. The rule below targets a realistic post-exploitation pattern: a compromised developer host downloading a follow-on script with curl over HTTP. Treat it as a heuristic indicator, not a direct exploit signature.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CVE-2026-73217 Cursor Sandbox Escape — Suspicious Script Download from Developer Host";
  flow:to_server,established;
  http.method; content:"GET";
  http.uri; content:".sh";
  http.user_agent; content:"curl/";
  classtype:trojan-activity;
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73217;
  threshold: type both, track by_src, count 1, seconds 60;
  sid:7321701; rev:1;)

Elastic Detection

EQL sequence correlating venv interpreter file modification with subsequent execution of that interpreter — the two-step signature of this vulnerability at the host level.

sequence by host.id, user.name with maxspan=5m
  [ file where event.category == "file" and event.action in ("modification", "write")
     and file.name in ("python", "python3")
     and file.path : ("*/.venv/bin/python*", "*/venv/bin/python*", "*/.venv/bin/python3*", "*/venv/bin/python3*") ]
  [ process where event.category == "process"
     and process.executable : ("*/.venv/bin/python*", "*/venv/bin/python*")
     and process.args : ("-c", "*subprocess*", "*os.system*") ]

Splunk SPL Query

(index=endpoint sourcetype="Sysmon" ((EventCode=11 TargetFilename="*\\venv\\bin\\python*") OR (EventCode=1 Image="*\\venv\\bin\\python*")))
| transaction host, user maxspan=5m
| where mvcount(EventCode) >= 2
| eval sandbox_escape_indicator=if(match(Image, "venv[/\\\\]bin[/\\\\]python"), "yes", "no")
| table _time, host, user, Image, CommandLine, TargetFilename, sandbox_escape_indicator

On macOS, Sysmon is not standard; substitute with Endpoint Security Framework (ESF) or osquery process/file event sources and adjust field names (e.g., process_executable, file_path) accordingly.

Wazuh OSSEC Rule

FIM-based detection: alert when a venv Python interpreter file changes. This detects the wrapper replacement step of the attack.

<group name="cve-2026-73217,">
  <!-- syscheck: venv python interpreter modified (parent rule 550 = integrity checksum changed) -->
  <rule id="409777" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.venv/bin/python</field>
    <description>CVE-2026-73217: virtual environment Python interpreter modified — possible Cursor sandbox escape wrapper</description>
    <group>syscheck,</group>
  </rule>

  <rule id="409778" level="12">
    <if_sid>550</if_sid>
    <field name="file">venv/bin/python</field>
    <description>CVE-2026-73217: workspace venv interpreter changed — possible sandbox escape wrapper</description>
    <group>syscheck,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source, despite the NVD description stating the issue is fixed in version 3.1.2. Defenders should treat the fix status as unconfirmed until the vendor publishes a release artifact or advisory that explicitly references CVE-2026-73217.

1. Immediate mitigations.

   • Disable Auto-Run Sandbox mode (and similar auto-run agent execution features) on macOS hosts running Cursor < 3.1.2 until the patch is verified.
   • Do not open untrusted repositories or process untrusted instructions with Auto-Run enabled; treat any agent-modifiable file as attacker-influenced.
   • Restrict write access to virtual environment directories (e.g., POSIX permissions, ACLs) so agents cannot replace interpreter binaries.
   • Deploy file-integrity monitoring (Wazuh syscheck, osquery, or EDR FIM) on all venv interpreter paths and alert on changes.

2. Patch / upgrade steps.

   • Upgrade to Cursor 3.1.2 or later per the NVD description; verify the version through the vendor's official release channel.
   • Because patch confidence is 0/4, verify the downloaded artifact's code signature and checksums, and confirm the release notes reference CVE-2026-73217 before broad deployment.
   • After upgrading, validate the fix by attempting to modify a venv interpreter inside an Auto-Run Sandbox session; the modification should be rejected or confined.

3. Long-term hardening.

   • Treat application-level sandboxes as a defense-in-depth layer, not a trust boundary. For agentic tooling, back them with OS-level sandboxing (macOS Seatbelt / sandbox-exec), endpoint protection, and EDR behavioral analytics.
   • Enforce least privilege for developer accounts, and isolate CI/CD credentials and secrets from interactive workstations.
   • Configure IDE extensions to validate interpreter integrity (code signature / hash) before execution; alert when a documented Mach-O interpreter becomes a script.
   • Log and centrally correlate agent execution events, file modifications, and process creations for agentic-IDE deployments, using the detection guidance above.

References

1. NVD entry for CVE-2026-73217: https://nvd.nist.gov/vuln/detail/CVE-2026-73217
2. CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
3. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-73217 is not listed (no known exploited vulnerability status at time of writing).
5. Vendor fix: NVD description indicates Cursor 3.1.2; no vendor advisory URL was present in the source data. No known threat actor campaigns or exploit-in-the-wild evidence are documented at this time; EPSS 0.00312 indicates low short-term exploitation likelihood per current data.