Which versions of Cursor are affected by CVE-2026-50548?

Cursor AI code editor versions prior to 3.0 contain a critical sandbox escape vulnerability enabling remote code execution on developer machines through prompt injection of agent commands.. A patch is available.

Is there a public PoC exploit available for CVE-2026-50548?

Yes, a public proof-of-concept exploit is available for CVE-2026-50548. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-50548?

Within 24 hours: Identify all instances of Cursor AI deployed across the organization and document current versions in use. Within 7 days: Upgrade all Cursor installations to version 3.0 or later. Within 30 days: Audit developer machines for indicators of compromise including unexpected process execution, file modifications outside authorized directories, and unusual network connections from affected systems.

Cursor CVE-2026-50548

Q: What is the CVSS score of CVE-2026-50548?

CVE-2026-50548 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-39537 CRITICAL

Path Traversal (CWE-22)

2026-06-25 GitHub_M

RCE Path Traversal Cursor

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-delivered malicious agent content with low complexity and no auth (PR:N), but a user must invoke the agent (UI:R); sandbox escape to host execution is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 20:03 EUVD

Analysis Generated

Jun 25, 2026 - 19:17 vuln.today

DescriptionCVE.org

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution - for example by overwriting the cursorsandbox helper so later commands run unsandboxed - with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.

AnalysisAI

Sandbox escape leading to non-sandboxed remote code execution affects the Cursor AI code editor prior to version 3.0, where agent terminal commands run in a sandbox that grants write access to the command's working directory. By manipulating the working_directory parameter, a malicious or prompt-injected agent can cause the sandbox to expose writable paths outside the intended workspace, then overwrite the cursorsandbox helper so subsequent commands execute outside the sandbox entirely. There is no public exploit identified at time of analysis, but the vendor rates this 9.3 (CVSS 4.0) with high confidentiality, integrity, and availability impact and notes it requires no user interaction beyond a benign prompt.

Technical ContextAI

Cursor is an Electron-based code editor (cpe:2.3:a:cursor:cursor) that embeds an AI agent capable of executing terminal commands on the developer's machine. To contain those commands it uses a sandbox (the cursorsandbox helper) that, by design, grants write access to the command's working directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the working_directory parameter is not properly constrained, so a manipulated value resolves to writable paths outside the intended workspace. Because the sandbox derives its writable set from this parameter, controlling it effectively widens the sandbox's write boundary and allows the protective helper binary itself to be replaced, collapsing the sandbox guarantee.

RemediationAI

Vendor-released patch: upgrade to Cursor 3.0, which fixes the working_directory path-traversal that allowed the sandbox to include writable paths outside the workspace; this is the primary and authoritative fix per the GitHub Security Advisory GHSA-3p48-7v9f-v5cw (https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw). For installs that cannot immediately update, reduce exposure by disabling agent auto-run of terminal commands or requiring manual approval for each command (trade-off: significantly reduces agent automation/productivity), avoiding opening or running the agent against untrusted repositories and prompts (trade-off: limits collaboration workflows), and running Cursor under a least-privileged OS user so that any escaped write occurs with minimal filesystem reach (trade-off: may break tooling that expects broader permissions). These are mitigations only; upgrading to 3.0 is the sole confirmed remediation.