CVE-2026-50549: Cursor agent writes outside workspace through symlink path fallback

Summary

Cursor versions before 3.0 run agent terminal commands in a sandbox by default. When the agent's path canonicalization fails before a Write, it falls back to the original path and writes without approval, so a malicious agent can use an in-workspace symlink to write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution, for example by overwriting the cursorsandbox helper, with no user interaction beyond a benign prompt.

Mitigation

Fixed in 3.0.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News