What is CVE-2026-50549?
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the workspace and force canonicalization to fail — either because the target does not exist or because read permission is removed from the path — so the agent writes through the symlink to an arbitrary location without approval. A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.
The record classifies CVE-2026-50549 under weakness class CWE-59. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 125 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 9.3 — Critical (derived from score)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EPSS (FIRST)
- 1.0% probability of exploitation in the next 30 days, higher than 62.1% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 7.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-06-25
Is CVE-2026-50549 being exploited?
It currently carries a trending score of 29 in the Threadlinqs vulnerability feed.
Affected products and versions
- cursor: cursor
How to fix CVE-2026-50549
No vendor patch reference has been recorded for CVE-2026-50549 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-50549
3 tracked threats in the Threadlinqs corpus reference CVE-2026-50549, either in the campaign’s CVE list or as an indicator on the campaign record.
- Unpatched Cursor IDE 0-Day: Malicious git.exe in Repository Root Enables Arbitrary Code Execution on Windows (CWE-427) — HIGH · 2026-07-15
- Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click Prompt Injection (CVE-2026-50548, CVE-2026-50549) — CRITICAL · 2026-07-01
- Critical Cursor AI Code Editor Flaws (CVE-2026-50548, CVE-2026-50549) — "DuneSlide" Zero-Click Prompt Injection to Sandbox Escape and RCE — CRITICAL · 2026-07-01
Sources
Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on .