Maland | Another Cursor 0-day Enabling Arbitrary Code Execution Beyond Git.exe

Summary

Security researchers at Pillar Security disclosed a class of vulnerabilities in AI coding agents — Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity — that undermines the assumption that agent commands running inside a sandbox are safe. In the demonstrated chains the sandbox often continued to enforce its restrictions, but files the agent wrote inside approved workspaces were later consumed and executed by trusted, unsandboxed host components such as extensions, task runners, Git integrations, Python tooling, hooks, or Docker services, yielding code execution beyond the sandbox without defeating OS isolation directly.^[0]

The most concretely tracked finding is a Cursor workspace-hook configuration issue assigned CVE-2026-48124 and fixed in Cursor 3.0.0. Additional Cursor chains abused Python interpreter discovery and Git metadata redirection outside a literal .git directory. OpenAI patched a Codex CLI command-allowlist bypass (git show side effects) in Codex CLI 0.95.0 with a high-severity bug bounty, and a shared privileged-Docker-service issue affecting Cursor, Codex CLI, and Gemini CLI was reportedly resolved.^[0][7]

There is no evidence of in-the-wild exploitation or a named threat actor; the material is coordinated vulnerability research with vendor fixes and hardening guidance. The core lesson is architectural: an agentic workspace is an event-driven control surface, and the true security boundary of an AI coding agent includes every file it can influence and every trusted component that may later act on that influence.^[0]

Attack chain

1. Initial reach via indirect prompt injection: An attacker conceals instructions in content the agent is likely to process — a README, source-code comment, Git issue or pull-request description, dependency metadata, retrieved web page, or generated log — so the model interprets hostile data as an instruction rather than the developer explicitly requesting the action.^[0]
2. Agent writes a project file: Following the injected instruction, the agent creates or modifies a project file (hook definition, Python virtual-environment interpreter, alternative Git metadata, or a .vscode task) inside a workspace location it is permitted to modify.^[0]
3. Sandbox permits the write: The sandbox allows the operation because the file resides within an approved workspace, so no isolation control is violated at the moment of the write.^[0]
4. Trusted host component consumes the artifact: An unsandboxed host component later discovers or loads the file — Cursor executing a hook, the Python extension discovering and running a manipulated interpreter, host-side Git executing an fsmonitor helper, or an editor running a VS Code task.^[0]
5. Delayed host-side execution: The trusted component performs an action outside the agent's restrictions, potentially after an editor refresh, a Git operation, interpreter discovery, or when the developer reopens the project — a delay that decouples the malicious write from the resulting execution and complicates incident response.^[0]

Disclosure timeline

How it works

The vulnerability class is a configuration-based trust handoff: rather than breaking sandbox isolation, the agent writes an artifact that an already-trusted, unsandboxed host process later interprets as configuration, metadata, an executable, or an instruction, causing deferred host-side execution. The agent never launches the final payload directly.^[0]

CVE-2026-48124 concerns Cursor's Claude-compatible hook configuration. Hooks automate commands around lifecycle events; if the agent writes a hook definition inside the project and Cursor later executes that hook outside the sandbox, the configuration file becomes a deferred command launcher.^[0][7]

A second Cursor chain abused Python interpreter discovery: the agent alters a project-local virtual environment's interpreter or structure, and Cursor's unsandboxed Python extension discovers and executes the manipulated interpreter during normal environment detection.^[0]

A third Cursor issue exploited Git metadata indirection — a .git file can point to metadata elsewhere — so path-based protections that only block writes to a conventional .git directory miss equivalent locations; modified Git configuration could invoke an fsmonitor helper the host-side Git integration later executed. Cursor patched this in 3.0.0 with a CVE pending.^[0]

Codex CLI's command allowlist trusted the git show command name even though specially selected parameters can produce changes or execution-relevant side effects, demonstrating that authorizing a command by name without modeling its full invocation, arguments, environment, and side effects creates a bypass.^[0]

A shared issue in Cursor, Codex CLI, and Gemini CLI allowed the agent to reach a privileged Docker service outside the sandbox, turning the daemon into a confused deputy that could create containers with host directories mounted or elevated capabilities — access to the control plane being itself a powerful capability not gated by the sandbox's approval checks.^[0]

Antigravity findings involved a macOS Seatbelt policy operating more like an allow-by-default profile with selected behavior denied, and VS Code task files that act as delayed execution mechanisms when an unsandboxed editor later runs an agent-created task.^[0]

Affected versions and patch status

Key takeaways

• Isolating an agent's execution is not the same as isolating its influence: the true boundary of an AI coding agent includes every file it can write and every trusted component that may later act on that file.^[0]
• Security rules keyed to familiar filenames or command names (a literal .git directory, or a 'safe' git show) are brittle because underlying tools support aliases, redirection, and side-effecting parameters; policy must evaluate complete invocations and side effects.^[0]
• Access to privileged local daemons such as Docker is itself a powerful capability that must cross the same approval checks as direct host execution, not be treated as inherently contained.^[0]
• The vulnerabilities are patched, but the architectural pattern — data becoming behavior through delayed trust handoffs — is broader than any single advisory and calls for deny-by-default sandboxes, file provenance, and telemetry connecting writes to consequences.^[0]

Defensive actions

• Update Cursor to 3.0.0 or later and Codex CLI to 0.95.0 or later before opening unfamiliar projects.: These releases contain the disclosed fixes, including CVE-2026-48124 in Cursor 3.0.0.^[0][7]
• Open unknown or untrusted repositories inside a disposable virtual machine or equivalent isolated environment, and discard it after the task.: A container alone may be insufficient if privileged host services or shared directories remain exposed; ephemeral environments remove planted artifacts and defeat delayed-execution attacks.^[0]
• Inspect newly created automation files — .vscode tasks, Git configuration, Python environments, container definitions, and agent hooks — before allowing them to run, and review the full diff including hidden files.: Agent-writable configuration is executed by trusted host components; provenance and review catch adversarial or accidental unsafe configuration.^[0]
• Keep Docker and other privileged local services unreachable by default and enable them only for projects that require them.: Access to a privileged Docker daemon can amount to host control via a confused-deputy chain even when filesystem access is blocked.^[0]
• Use low-privilege, short-lived, narrowly scoped credentials stored outside agent-readable paths and separate development environments from production authority.: Host-level execution under a developer account can lead to source-code, package, and cloud compromise without administrator privileges.^[0]
• Enforce security-sensitive agent settings above the project level and preserve logs that link agent file writes to later host execution.: Local users may weaken approval or sandbox settings, and delayed execution requires provenance telemetry to detect trust-handoff attacks.^[0]