AI SECURITYLABS

Security for Cursor Development: It wasn't a one-off

Part 5 of 16

It wasn’t a one-off

  • Trusted forever: Check Point found that “Once an MCP is approved, future modifications to its command or arguments are trusted without any additional validation or prompt” (MCPoison, CVE-2025-54136, fixed in 1.3).
  • A git hook outside the sandbox: Novee used a nested bare repository with a malicious pre-commit hook to run code outside Cursor’s sandbox (CVE-2026-26268, fixed in 2.5).
  • Sandbox escapes through paths: Cato Networks’ DuneSlide escaped the sandbox through an agent-controlled working directory and a symlink with failed path canonicalisation (Cato Networks, fixed in 3.0).
  • Shell builtins the parser missed: Straiker’s NomShub broke out of the macOS sandbox with cd and export to write ~/.zshenv (Straiker, fixed in 3.0).
  • Still arriving: a sandbox escape through a tampered Python virtual environment was fixed in 3.1.2 (CVE-2026-73217).