Advisories › ACVE-2026-0435

ACVE-2026-0435

Cursor CLI 2026.07.23 on macOS, opened on an attacker-controlled workspace, ran code outside its sandbox with the logged-in user's authority without a permission prompt.

Exposure

Harness

Cursor CLI 2026.07.23-e383d2b and earlier on macOS — confirmed, accomplish.ai

Model

any — unconfirmed

Goal

Any task opened in an attacker-controlled workspace (goal not stated by the source) — unconfirmed

Tools and settings

Cursor CLI's macOS Seatbelt sandbox and internal git paths — confirmed, accomplish.ai

Approval

The sandbox was the remaining guardrail when permission prompts were disabled, but the git path escaped it — confirmed, accomplish.ai

Input controlled by

repo-author

What the agent does

The harness runs workspace-controlled code outside the macOS sandbox.

Harm

arbitrary-command

Reach

The Mac and the logged-in user's files — confirmed, accomplish.ai (the home directory, project files)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity

HIGH

Status

Unverified

Kind

Code

Source date

2026-09-12

Modified

2026-09-25

Aliases

No CVE assigned — No CVE was assigned in the public disclosure.

Affected

• AgentHarness: cursor-cli — < 2026.08.04-aaa8809

Harness/product

cursor-cli

Classes

sandbox-escape; config-file-injection; CWE-693

Taxonomy

ASI: ASI05; ATLAS: AML.T0105

Licence

CC-BY-4.0 advisories; MIT code

Report a problemJSON