Unpatched Cursor Flaw Lets Malicious Repositories Run Code

AI coding agents can edit files and run shell commands, making sandboxing a critical barrier against mistakes, prompt injection and malicious repositories. Pillar Security said Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI and Antigravity exposed indirect paths around that boundary. Rather than breaking isolation directly, an agent could alter workspace settings, Git configuration or Python virtual-environment files that trusted tools later execute outside the sandbox; in some setups, Docker could also provide access to the host.

The findings were reported on July 21, 2026. Cursor’s Python virtual-environment flaw affected releases before 3.1.2 and was fixed in 3.1.2, while CVE-2026-48124 affected Cursor Desktop 2.4.37 and was patched in 3.0.0. OpenAI corrected Codex CLI’s incomplete validation of supposedly safe Git commands in version 0.95.0. Pillar also described a macOS scenario involving Docker Desktop, Dev Containers CLI and network-enabled Auto-Run Sandbox mode that could let an agent access a user’s home directory and run host commands without another approval prompt.

Cursor is a widely used AI coding tool that can read project content and invoke system functions, making its sandbox an important defense for isolating untrusted instructions. Cato Networks said prompt injection that crosses this boundary could place malicious code directly inside development environments, putting source code, credentials and companies’ internal systems at risk.

Cato Networks security researchers recently disclosed two critical vulnerabilities collectively dubbed “DuneSlide.” Attackers could launch a prompt-injection attack when a victim processes malicious content, bypassing Cursor’s sandbox and executing arbitrary system commands. Cursor patched the flaws in version 3.0. As of the disclosure, the company had not reported the number of affected users or the value of any actual losses. Users should upgrade as soon as possible.

Cursor, an AI code editor developed by Anysphere, uses models and extensions to assist with software development and debugging. Cybersecurity research firm LayerX said Cursor stores API keys and connection tokens in a local SQLite database, potentially putting developers’ cloud services, source code and enterprise systems at risk if access controls are inadequate.

LayerX recently disclosed a design flaw dubbed “CursorJacking” that allows malicious third-party extensions to read Cursor’s local database and steal API keys and connection tokens. As of July 20, 2026, Anysphere had not announced a patch, a remediation date or the amount of any losses. Users should avoid installing extensions from unknown sources for now.