Cursor is a code editor built for programming with AI

CVE-2026-50548 is a path-traversal / sandbox scoping bug in the Cursor AI code editor's run_terminal_cmd tool. When the agent invokes a shell command, it can pass an optional working_directory parameter. Cursor's automatic terminal sandbox blindly appends that path to the *allowed write list*. If an attacker plants an indirect prompt-injection payload — via a poisoned MCP server response, a search-result blob, a README the agent reads, or a compromised dependency doc — the LLM can be steered to set working_directory to a sensitive path (e.g. the folder holding the cursorsandbox helper binary) and then overwrite that helper. Subsequent shell invocations execute *outside* the sandbox as the developer's user. Every Cursor build prior to 3.0 (released 2026-04-02) is affected; the fix stopped adding arbitrary agent-supplied paths to the allowlist.

The vendor label of CRITICAL / 9.8 (AV:N/AC:L/PR:N/UI:N) is the CVSS treatment you get when a scoring team assumes 'network-reachable code execution with no interaction.' In reality the attacker must (a) get untrusted content in front of the agent, (b) win a prompt-injection race against Cursor's guardrails, and (c) rely on the victim actually running an AI-assisted session. And when it lands, it lands on one developer workstation — not a server tier, not a domain controller. This is a real bug worth patching, but 9.8 misreads it. Reassessed as MEDIUM (6.2): unauthenticated conceptually, but the exploitation surface is a running IDE session and the blast radius is a single user's endpoint.

Why this verdict

• Client-side scope: The affected component is an IDE running on developer laptops. Blast radius is one user's endpoint per successful chain, not a shared service. This removes the AV:N assumption baked into the 9.8.
• Requires agent-mode session + tainted input: Exploitation is impossible unless a Cursor agent session is actively running AND the agent is fed attacker-controlled content (MCP, search result, poisoned repo). This is post-social-engineering-adjacent friction, not drive-by.
• Approval-gate friction: Users who did not enable YOLO/auto-run see the anomalous working_directory in an approval prompt and can reject. That kills the chain before the sandbox write.
• Fully patched, no listener, no fleet-wide scan target: Cursor auto-updates; the population on <3.0 shrinks weekly. GreyNoise/Shodan cannot enumerate it because there is no listening service.
• Role multiplier — developer workstation: Typical role. Chain succeeds with outcome = credential/source theft on one endpoint. Serious for that user, but does not escalate to fleet takeover by itself.
• Role multiplier — maintainer / release-engineer workstation: Chain succeeds; outcome escalates to supply-chain pivot if the victim pushes signed releases or has CI publish rights. This is the reason the verdict is not LOW — but this cohort is <5% of a typical Cursor install base, so it sets pressure toward HIGH without breaking the MEDIUM floor.
• Role multiplier — CI/CD build agent running Cursor: Not a canonical deployment. Cursor is not typically installed on shared build infrastructure, so this role does not apply.

Why not higher?

Not HIGH because the affected component is not a canonical high-value-role component (not a hypervisor, IdP, PAM, CA, backup server, or kernel-mode agent). The chain requires an active agent session ingesting attacker-tainted content, and outcome is per-endpoint compromise rather than fleet or identity-scale impact. Supply-chain escalation is possible for a narrow maintainer cohort but does not represent the installed base.

Why not lower?

Not LOW because a working PoC exists, exploitation requires no privileged position (unauthenticated content injection through MCP/search is realistic), and post-exploitation on a developer machine yields SSH keys, cloud creds, and git push rights that DO give attackers a foothold into higher-value systems. Developer endpoints are a well-known pivot target.

1. Force-upgrade Cursor fleet to ≥3.0 — Roll the upgrade through MDM (Jamf, Intune, Kandji) or block launch of older builds via app control. This is the fix — every other control is a workaround. Deploy within the noisgate remediation SLA of 365 days, but realistically finish within 30 days because the population is self-updating anyway.
2. Disable Cursor auto-run / YOLO mode via managed policy — Require manual approval for run_terminal_cmd. This forces the anomalous working_directory value in front of the user before the sandbox is expanded. Push via Cursor's enterprise settings JSON deployed by MDM immediately — no mitigation SLA under MEDIUM, but this is a same-week config change.
3. Restrict MCP servers to an enterprise allowlist — Untrusted MCP servers are the primary indirect-prompt-injection vector. Publish an internal registry and block outbound to arbitrary MCP endpoints at the proxy. Ties into your existing egress controls.
4. Rotate developer cloud credentials to short-lived STS / OIDC-federated tokens — Assume any developer endpoint may be compromised via a client-side RCE class of bug. Killing long-lived AWS keys, GCP service account JSON, and static Azure secrets on disk breaks the pivot from stage 5.
5. Require hardware-key commit signing for release-authority repos — Prevents the maintainer-cohort escalation into supply-chain compromise even if the workstation is popped.
6. EDR behavioral rule: alert on Cursor helper writing to its own install directory — The cursorsandbox overwrite is the observable IOC. A single behavioral rule on 'Electron IDE modifies own launcher' catches this exploit and future variants.

Run on each macOS/Linux developer endpoint (via your MDM's shell-execution feature, e.g. Jamf policy, Intune script, or Kandji script). Invoke as bash check-cve-2026-50548.sh under the target user's account. No elevated privileges required — Cursor lives in the user's Applications / ~/.local dir.

#!/usr/bin/env bash
# check-cve-2026-50548.sh
# Detects vulnerable Cursor IDE installs (<3.0) — DuneSlide working_directory sandbox escape.
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

found=0
vulnerable=0

version_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  printf '%s\n%s\n' "$1" "$2" | sort -V -C
}

check_version() {
  local ver="$1" src="$2"
  found=1
  if [ -z "$ver" ]; then
    echo "UNKNOWN: could not read version from $src"
    return
  fi
  local major="${ver%%.*}"
  if ! [[ "$major" =~ ^[0-9]+$ ]]; then
    echo "UNKNOWN: unparsable version '$ver' from $src"
    return
  fi
  if [ "$major" -lt 3 ]; then
    echo "VULNERABLE: Cursor $ver at $src (<3.0)"
    vulnerable=1
  else
    echo "PATCHED:    Cursor $ver at $src"
  fi
}

# macOS system-wide install
MAC_PLIST="/Applications/Cursor.app/Contents/Info.plist"
if [ -f "$MAC_PLIST" ]; then
  v=$(/usr/bin/defaults read "${MAC_PLIST%.plist}" CFBundleShortVersionString 2>/dev/null || true)
  check_version "$v" "$MAC_PLIST"
fi

# macOS per-user install
USER_PLIST="$HOME/Applications/Cursor.app/Contents/Info.plist"
if [ -f "$USER_PLIST" ]; then
  v=$(/usr/bin/defaults read "${USER_PLIST%.plist}" CFBundleShortVersionString 2>/dev/null || true)
  check_version "$v" "$USER_PLIST"
fi

# Linux AppImage / extracted
for cand in \
  "$HOME/.local/share/cursor/resources/app/package.json" \
  "/opt/cursor/resources/app/package.json" \
  "/usr/share/cursor/resources/app/package.json"; do
  if [ -f "$cand" ]; then
    v=$(grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' "$cand" | head -1 | sed -E 's/.*"([^"]+)"$/\1/')
    check_version "$v" "$cand"
  fi
done

# CLI on PATH as last resort
if command -v cursor >/dev/null 2>&1; then
  v=$(cursor --version 2>/dev/null | head -1)
  check_version "$v" "$(command -v cursor)"
fi

if [ "$found" -eq 0 ]; then
  echo "UNKNOWN: Cursor not detected on this host"
  exit 2
fi
if [ "$vulnerable" -eq 1 ]; then
  exit 1
fi
exit 0

Sources

1. NVD — CVE-2026-50548
2. Cato Networks — DuneSlide research (Itay Ravia)
3. The Hacker News — Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox
4. CSO Online — Sandbox bypass flaws in Cursor IDE
5. Hard2bit — Prompt injection as an RCE vector in AI editors
6. Mallory — DuneSlide Flaws in Cursor IDE
7. Tenable — Cursor <3.0 Multiple Vulnerabilities
8. OpenCVE — CVE-2026-50548