CVE-2026-73217

unknowncovered by 1 sourcefirst seen 2026-08-11

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications. This issue is fixed in version 3.1.2.

⚡ Watch CVE-2026-73217

Get an email if CVE-2026-73217 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-73217: Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS al…nvd · 2026-08-11

External references

NVD record for CVE-2026-73217

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-73217 status](https://www.csirts.com/badge/CVE-2026-73217)](https://www.csirts.com/cve/CVE-2026-73217)