Cursor (Anysphere) Cursor at a glance
Cursor's advisories for CVE-2026-50548 and CVE-2026-50549, found by Cato AI Labs, describe two ways a manipulated agent could write outside the workspace and disable the terminal sandbox. Both are rated critical (NVD CVSS 9.8) and fixed in Cursor 3.0.
Cursor (Anysphere) Cursor: status
- Affected
- Cursor desktop before 3.0
- Status as of
- Discovered by
- Cato AI Labs (Cato Networks); Maor Dokhanian is also credited on CVE-2026-50549
What changed with Cursor (Anysphere) Cursor
Cursor runs the agent's terminal commands in a sandbox that may write only inside the workspace. CVE-2026-50548 let the agent set the command's working_directory to a sensitive location, which the sandbox then treated as writable. CVE-2026-50549 let it create an in-workspace symlink pointing outside, force the path check to fail, and write through the link without approval. Either write could overwrite the cursorsandbox helper so later commands ran unsandboxed, with only a harmless-looking user prompt.
Cursor published advisories GHSA-3p48-7v9f-v5cw and GHSA-3v8f-48vw-3mjx on June 5, 2026, rated Critical and crediting Cato AI Labs (Maor Dokhanian is also credited on the second). The NVD scores both 9.8 under CVSS 3.1, and GitHub scores them 9.3 under CVSS 4.0. Cato published details under the DuneSlide name on July 1; press reports say injected text could arrive through MCP responses or web search results, and that the fixes shipped in Cursor 3.0 on April 2.
How to fix it: Cursor (Anysphere) Cursor
1. Update
Update Cursor to 3.0 or later. The sandbox no longer grants write access based on an agent-controlled working directory, and writes are blocked when a target path cannot be resolved.
github.com (opens in a new tab)
Advisories
Why Cursor (Anysphere) Cursor matters for businesses
Sandboxes are the main safety net when an agent reads outside content, and these bugs show a single prompt injection can switch that net off. Make sure every developer machine runs Cursor 3.0 or later, and keep in mind that MCP servers and web search results are untrusted input to your coding agent.
Sources for this story
- Cursor Desktop sandbox escape via agent-controlled working directory (GHSA-3p48-7v9f-v5cw) (opens in a new tab)Official
Cursor on GitHub · github.com
- Cursor Desktop sandbox escape via symlink and failed path canonicalization (GHSA-3v8f-48vw-3mjx) (opens in a new tab)Official
Cursor on GitHub · github.com
- CVE-2026-50548 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- CVE-2026-50549 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands (opens in a new tab)Press
The Hacker News · thehackernews.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #prompt-injection
- #sandbox-escape
- #ai-coding-agents
- #cursor