Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-17 | 1 | Disclosure1 |
| 2026-07-21 | 1 | Patch1 |
| 2026-09-12 | 1 | General1 |
| 2026-09-13 | 1 | Disclosure1 |
An agent, fully inside its sandbox, writes a file the boundary was never designed to police - a .claude hook, a .vscode task config, a modified venv. Something outside the sandbox reads and executes it later. CVE-2026-35603 and CVE-2026-48124 came out of that wave.
Post summary
The text briefly references two CVEs linked to sandbox escape via file manipulation but offers no details, exploits, patches, or evidence of real‑world attacks.
Four findings, same shape. Cursor: a hook configuration file, written inside the workspace, ran commands on the host. CVE-2026-48124, fixed in 3.0.0. Cursor again: the agent modified a Python virtual environment, and the editor's Python extension then executed the modified interpreter automatically. Cursor a third time: alternative git metadata bypassed the path-based security checks. Codex: an allowlist that matched on the name of a binary rather than its identity. And one Docker socket finding hit Codex, Cursor and Gemini CLI at once. A privileged local daemon the agents could reach became an unsandboxed place to run code. Cymulate documented this class in April across Claude Code, Gemini CLI and Codex CLI and named it configuration-based sandbox escape. A file written inside the sandbox runs on the host at next launch. Four vendors, independent teams, same underlying assumption.
Post summary
Four findings expose a configuration‑based sandbox escape in CVE-2026-48124 affecting Cursor, Codex, Gemini CLI, and related tools, with remediation available in version 3.0.0.
🛡️ Cursor 3.0.0 patches CVE-2026-48124, but the bigger lesson is brutal: a sandbox means little when trusted tools run the AI’s leftovers. “Contained” was doing a lot of work. https://windowsforum.com/threads/cursor-3-0-0-fixes-cve-2026-48124-sandbox-to-host-code-execution.439817/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #Cursor #DeveloperSecurity #AiCodingSecurity #SandboxEscapes https://t.co/SZiThfeaVG
Post summary
The post announces that Cursor 3.0.0 contains a patch for CVE‑2026‑48124, highlighting sandbox limitations when trusted tools run AI leftovers, without evidence of active exploitation or PoC code.
CVE-2026-48124: Cursor Desktop Sandbox Escape via Claude Hook https://thecybrdef.com/cve-2026-48124-cursor-desktop-sandbox-escape-via-claude-hook/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The text announces CVE‑2026‑48124 and provides a link for further information, without detailed technical or exploit details.