CVE-2026-50548: Cursor sandbox escape through agent working_directory parameter

Summary

Cursor versions prior to 3.0 run agent terminal commands in a sandbox that grants write access to the command's working directory. A flaw in how the agent could modify the working_directory parameter let the sandbox include writable paths outside the workspace, so a malicious agent could write arbitrary files under the user's privileges, including overwriting the cursorsandbox helper to run later commands unsandboxed, with no user interaction beyond a benign prompt.

Mitigation

This vulnerability is fixed in 3.0.

Coverage

News, research and other items that mention CVE-2026-50548.

• Cursor security: top 10 attacks and what each one actually brokeAdversa AI Blog · 2026-11-03

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News