CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working directory
Description
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and Moreen·The Hacker News· Roundup malware
- Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Executionen-us·SecurityWeek· Research cursor rce
- Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commandsen·The Hacker News· Patch Cursor AI Code Editor rce
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-50548 and every CVE in our database. Create a free account — no credit card required.
Create Free Account