CVE-2026-63093

Cursor IDE for macOS before version 3.0.0 allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read/write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt.

Cursor IDE for macOS before version 3.1.2 allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications.

A vulnerability in Cursor editor before 03/31/2026 allowed attacker-controlled web content to connect to an unauthenticated local agent endpoint, enabling code execution in the cloud agent sandbox and access to files, repositories, environment variables, credentials, and GitHub App tokens. The issue was fixed on 03/31/2026 by requiring authentication for the relevant endpoint.

In Cursor code editor versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones, allowing a malicious agent to read protected files.

Cursor versions 1.7.44 and below have NTFS path quirks that allow a prompt injection attacker to bypass sensitive file protections and overwrite files requiring human approval. Modification of some protected files can lead to RCE.

In Cursor code editor versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipulation via forward slashes but not via backslashes, allowing an attacker with prompt injection or other control to overwrite sensitive editor files without approval on Windows machines.

In Cursor versions 1.7.28 and below, an input validation flaw in MCP server installation lets crafted deep-links bypass standard security warnings and conceal executed commands from users. If the victim accepts the server, commands specified by the attacker's deep-link are executed.

Cursor IDE versions 1.6.23 and below use case-sensitive checks when protecting sensitive files (e.g., */.cursor/mcp.json), allowing attackers to modify their content via prompt injection. On case-insensitive filesystems this can lead to full remote code execution.

A vulnerability in Cursor code editor versions 1.7 and below. Automatic loading of project-specific CLI configuration (.cursor/cli.json) could override global settings and enable remote code execution through permissive configuration and prompt injection.

Cursor versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, allow an attacker to impersonate a malicious MCP server and return crafted, maliciously injected commands during interaction, leading to command injection and potential remote code execution. This could allow arbitrary code execution on the host by the agent with full user privileges. No fixed release version exists, but patch 2025.09.17-25b418f is available.