CVE-2026-50549 Details

A vulnerability in Cursor, a code editor designed for programming with AI, allows for sandbox escape and non-sandboxed remote code execution. This issue affects versions prior to 3.0. The vulnerability arises because, before writing files, the application attempts to canonicalize the target path to ensure it remains within the designated workspace. However, if this process fails, the application defaults to the original path and writes without proper authorization. A malicious agent can exploit this by creating a symlink within the workspace that points to an external location, deliberately causing the canonicalization to fail—either by pointing to a non-existent target or by removing read permissions from the path. As a result, the agent can write files through the symlink to arbitrary locations outside the workspace, using the user's privileges. This exploitation could involve overwriting the 'cursorsandbox' helper, allowing subsequent commands to be executed outside the sandboxed environment, all without any user interaction except for a harmless prompt.

Users are advised to update Cursor to version 3.0, where this vulnerability has been addressed. In the patched version, canonicalization failures are treated as untrusted, and writes are blocked when a target path cannot be properly resolved, including cases where read permissions are removed to disrupt the resolution process.