CVE-2026-50548 Details
Description
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.
A vulnerability in Cursor, a code editor designed for programming with AI, prior to version 3.0, allows for non-sandboxed remote code execution. By default, Cursor runs agent terminal commands in a sandbox that grants write access to the command's working directory. However, a flaw exists that allows the agent to manipulate the 'working_directory' parameter, potentially leading the sandbox to include writable paths outside the intended workspace. A malicious agent could exploit this by directing the 'working_directory' to a sensitive location and writing arbitrary files outside the workspace, under the user's privileges. This could be used to overwrite the 'cursorsandbox' helper, enabling later commands to run unsandboxed, with no user interaction required beyond a simple prompt.
Users are advised to update Cursor to version 3.0, where the sandbox no longer allows write access based on an agent-controlled working directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| anysphere cursor | < 3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |