CVE-2026-50548Disclosure(anysphere / cursor)

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch anysphere cursor systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.

anysphere CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw

Weakness type (CWE)

CWE-22

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cursor

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
28 mentions across 15 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 11 signals
Technical details provided in 26 signals
Disclosure: 17 classified signals
Peaked 10d ago at 5 mentions (2026-07-02); latest day: 1
28 total mentions across 15 days

Affected systems

Vendors

anysphere

Products

cursor

Deep dive

Activity timeline28 mentions / 15d

Signal classification4 categories

Disclosure

1760.7%

Patch

621.4%

Active Exploitation

310.7%

General

27.1%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-06	1	Disclosure1
2026-06-26	1	Patch1
2026-06-29	1	Patch1
2026-07-01	3	Active Exploitation1Disclosure1General1
2026-07-02	5	Disclosure5
2026-07-03	1	Disclosure1
2026-07-04	2	Disclosure1Patch1
2026-07-05	3	Active Exploitation1Disclosure2
2026-07-06	4	Disclosure4
2026-07-08	1	Disclosure1
2026-07-09	2	Patch2
2026-07-23	1	General1
2026-08-05	1	Patch1
2026-08-19	1	Active Exploitation1
2026-08-21	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews111d
Disclosure
🛑 Two Cursor vulnerabilities could let hidden prompt-injection instructions escape the editor’s terminal sandbox and run commands on a developer’s machine. Tracked as CVE-2026-50548 and CVE-2026-50549, they affect versions before 3.0. See how it works: https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html
Post summary
Two Cursor vulnerabilities (CVE‑2026‑50548/50549) allow hidden prompt injection to escape the editor’s sandbox and execute commands; a linked article provides further details but no patch, exploit code, or active exploitation is reported.
2180461617.0K
2.3M followersView on X
Perturb AI@perturbaix107d
Disclosure
two critical vulnerabilities just confirmed in Cursor AI code editor. CVE-2026-50548 and CVE-2026-50549. CVSS score: 9.8. called DuneSlide. zero-click prompt injection. escapes the sandbox. executes arbitrary code on the underlying OS. the attack triggers when you ask the IDE to read an attacker-controlled file. that is it. you just have to open a file. your AI coding assistant is now a remote code execution vector. Cursor has 4 million+ developers using it daily. this is not a theoretical AI security risk. it is a confirmed 9.8 CVSS vulnerability in the AI tool your engineering team uses right now: http://perturbai.io
Post summary
Two critical CVEs (CVE‑2026‑50548/49) in Cursor AI’s code editor are reported with zero‑click RCE via prompt injection; no PoC, exploit code, patch or active exploitation details are provided.
30190666
223 followersView on X
Daily CyberSecurity@Daily_CyberSec106d
Disclosure
Discover the new Cursor IDE RCE vulnerability called DuneSlide. This critical sandbox escape flaw assigned CVE-2026-50548 threatens developer environments. #CursorIDE #RCE #DuneSlide #CyberSecurity #CVE202650548 http://securityonline.info/cursor-ide-rce-vulnerability/
Post summary
The text announces a newly discovered RCE vulnerability (CVE‑2026‑50548) in Cursor IDE, highlighting its critical sandbox escape nature. No PoC, exploit, active exploitation, patch, or false‑positive claim is included.
030511.0K
12.9K followersView on X
Jens Ernstberger@0xSerious62d
Active Exploitation
This is already happening: in June, a hidden HTML-comment prompt injection steered Claude Code's GitHub Action into reading and exfiltrating an API key. Around the same time, a zero-click MCP/web-search injection in Cursor (CVE-2026-50548/50549, CVSS 9.8) walked an agent into disabling its own sandbox.
Post summary
The passage reports ongoing exploitation of the 2026‑50548/50549 vulnerabilities via zero‑click injection, confirming active use of these high‑severity flaws in the wild.
11060240
755 followersView on X
iototsecnews@iototsecnews104d
Patch
Cursor IDE の RCE 脆弱性 CVE-2026-50548／50549：プロンプト・インジェクションによるサンドボックス・エスケープ https://iototsecnews.jp/2026/07/01/critical-cursor-ide-rce-vulnerabilities-enable-prompt-injection-in-zero-click/ 先端の AI 技術を搭載した開発ツール Cursor IDE において、隔離された安全な環境の制限を突破されてしまう深刻な欠陥 CVE-2026-50548／CVE-2026-50549 が報告されました。この問題の背景には、外部の検索結果などを AI が読み込む際に、特定の命令文によってファイル操作の経路検証をすり抜けられてしまうという構造上の隙があります。もし悪用されると、利用者が気付かないうちに開発用の大切なシステムファイルが上書きされ、作業用コンピュータ全体の制御を奪われるなどの重大な被害に繋がります。確実な対応策として、まずは利用しているツールを最新の状態に更新してください。また、信頼できない外部のデータや未検証の接続先を AI に直接読み込ませないよう、運用の制限を設けることが大切です。 #AI/ML #CVE202650548 #CVE202650549 #CursorIDE #Vulnerability
Post summary
The article warns of critical RCE vulnerabilities in Cursor IDE via prompt injection, advises updating the software and tightening data ingestion controls to mitigate the risk.
01060253
512 followersView on X
SecurityWeek@SecurityWeek109d
Disclosure
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - (CVE-2026-50548 and CVE-2026) 50549https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/
Post summary
The headline announces newly identified vulnerabilities in Cursor AI Code Editor that allow OS‑level remote code execution, but offers no further context beyond the basic description.
120402.4K
228.7K followersView on X
Moit Reghason@MoitReghason107d
Active Exploitation
Everyone’s celebrating agents trading tokenized stocks on Robinhood Chain. Few people are asking what happens when the infrastructure underneath those agents gets compromised. @cursor_ai recently disclosed CVE-2026-50548, a zero-click remote code execution vulnerability where a poisoned MCP response could disable the sandbox and execute code on a developer’s machine. That’s not a hypothetical attack surface. That’s the environment where agent infrastructure gets built. And it’s not an isolated incident. ➠ mcp-pinot-server carries a CVSS 10.0 unauthenticated RCE vulnerability. ➠ Kong’s mcp-konnect allows indirect prompt injection through poisoned data that can steer agent API calls without the user realizing it. ➠ mcp-memory-service exposed unauthenticated endpoints capable of leaking sensitive agent memory data. Each vulnerability adds another entry point to the same expanding attack surface. The recent Taiko bridge exploit made this painfully concrete. $1.7M was drained, not because the cryptography failed, but because a private key was committed in plaintext to a public GitHub repository. The SGX enclave performed exactly as designed. The operational discipline didn’t. What this means for the agent economy is that security debt compounds with every new integration. Cisco’s State of AI Security 2026 found that 71% of organizations are running unmonitored AI agents with broad MCP access. OWASP’s recently published MCP Top 10 found widespread issues across the ecosystem, including path traversal vulnerabilities and extremely limited adoption of standardized authentication mechanisms. As agents gain wallet-signing authority through ecosystems like @virtuals_io and agent key management systems such as @KeeperHubApp, the blast radius of a single operational failure grows proportionally. A private key left in a public repository could drain an autonomous agent treasury just as easily as it drained a bridge. The uncomfortable reality is that the weakest link in this stack was never the cryptography. It was always going to be the person who committed it.
Post summary
The disclosed zero‑click RCE (CVE‑2026‑50548) is corroborated by real‑world exploitation, specifically the Taiko bridge incident that drained $1.7M, and the text highlights additional high‑severity MCP vulnerabilities.
20040331
2.7K followersView on X
Upwind Security MDR@UpwindMDR116d
Patch
🚨 CRITICAL - Cursor agent sandbox escape via working_directory path manipulation (CVE-2026-50548) Cursor (AI-assisted code editor) versions prior to 3.0 contain a sandboxing flaw where the agent can tamper with the working_directory parameter, causing the sandbox to include writable paths outside the intended workspace. The root cause is improper input validation / sandbox path traversal that fails to constrain the working directory to a safe, expected root. An attacker exploits this by getting a user to run or approve an agent action that modifies working_directory to point outside the workspace, enabling arbitrary file writes under the user’s privileges. Impact includes sandbox escape and non-sandboxed remote code execution by overwriting executables or helper components (e.g., the cursorsandbox helper), plus broader file tampering and persistence on the host. 👉 Affected: Cursor < 3.0 | Upgrade to 3.0
Post summary
CVE‑2026‑50548 is a sandbox escape vulnerability in Cursor versions prior to 3.0 that allows arbitrary file writes and remote code execution; upgrading to 3.0 is the recommended fix.
10040136
291 followersView on X
ProtAAPP - Protege las AAPP@ProtAAPP106d
Disclosure
Cato Networks alerta sobre dos vulnerabilidades críticas en el editor de código AI Cursor, CVE-2026-50548 y CVE-2026-50549 (CVSS 9.8). Permiten inyecciones de comandos sin clic que ejecutan código arbitrario en el sistema operativo subyacente. https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/ https://t.co/bYVKNgnpvx
Post summary
Cato Networks alerts about two critical CVEs (CVE-2026-50548 and CVE-2026-50549) in the AI code editor Cursor, noting CVSS of 9.8 and remote command injection that can run arbitrary OS-level code.
00021289
8.3K followersView on X
Bryan@so_sthbryan109d
Patch
Two Cursor flaws let one prompt escape the sandbox. DuneSlide (CVE-2026-50548, CVE-2026-50549): - CVSS 9.8, no click required - Prompt injection runs arbitrary commands on dev machines - Patched, but every Cursor build before the fix is exposed Update today, then audit your tabs. https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html
Post summary
Two new Cursor vulnerabilities (CVE‑2026‑50548 & CVE‑2026‑50549) with a CVSS score of 9.8 allow prompt injection for arbitrary command execution; the issues are already patched, and users are urged to update and audit their environment.
11010106
106 followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi103d
Patch
الثغرات: CVE-2026-50548 | التقييم: 9.8 CVE-2026-50549 | التقييم: 9.8 المشكلة موجودة في Cursor قبل الإصدار 3.0، وتم إصلاحها في Cursor 3.0 بتاريخ 2 أبريل. حسب Cursor، أكثر من نصف شركات Fortune 500 يستخدمون الأداة تخيل مقدار الضرر لو تسربت الثغره او وقعت في يد الشخص الخطأ ؟
Post summary
The text announces CVE-2026-50548 and CVE-2026-50549, both rated 9.8, fixes them in Cursor 3.0 released April 2, without providing exploit or PoC details.
100101.3K
49.3K followersView on X
TechPulseHK@TechPulseHK108d
Disclosure
Cursor IDE 爆 RCE 漏洞 — prompt injection 可以直接突破 sandbox，唔洗你㩒任何掣。 CVE-2026-50548 同 50549：攻擊者透過 MCP server 或者搜尋結果 inject 惡意 payload，Cursor 嘅 AI agent 就會自動改 working_directory 寫檔案出 project root，甚至 overwrite sandbox 本身嘅 executable。仲有一個 symlink bypass：canonicalization fail 時會 fallback 用 original path，照樣跳出 sandbox。 Cato 話呢啲 logic flaw 唔止 Cursor 有，佢哋正對所有主流 coding agent 做 disclosure。香港 indie dev 用緊 AI IDE 嘅，即刻 check 係咪行緊 v3.0 以上 — 呢個唔係理論風險，係已經有完整 exploit chain 嘅 0-click 漏洞。 #Cursor
Post summary
The message discloses two CVEs (CVE‑2026‑50548 & 50549) that allow 0‑click RCE through prompt injection, sandbox bypass, and symlink exploitation, but it does not provide PoC code, active exploitation reports, or fixes.
10010127
24 followersView on X
Aviatrix Threat Research Center@aviatrixtrc111d
Active Exploitation
TRC analysis shows attackers exploited critical sandbox escape flaws in Cursor AI editor (CVE-2026-50548, CVE-2026-50549) to execute arbitrary commands on developer machines. The vulnerabilities allow file writes outside intended workspaces, creating pathways for remote code execution without user interaction. #DevSecOps 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/critical-cursor-flaws-cve-2026-50548-cve-2026-50549
Post summary
The post reports that CVE-2026-50548 and CVE-2026-50549 were actively exploited by attackers to escape sandboxes and execute arbitrary commands on developer machines, enabling remote code execution.
1001081
1.9K followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 Critical - Sandbox Escape & RCE in Cursor AI Editor (CVE-2026-50549, CVE-2026-50548) Two critical vulnerabilities have been disclosed in Cursor's AI agent sandbox. Malicious agents can exploit canonicalization failures via symlinks or manipulate the working_directory parameter to write arbitrary files outside the workspace under the user's privileges. 👉 Leads to unsandboxed Remote Code Execution (RCE) with zero user interaction | Upgrade Cursor to version 3.0 immediately to block these vectors
Post summary
Two critical vulnerabilities in Cursor AI Editor enable sandbox escape and RCE; immediate upgrade to version 3.0 is recommended for mitigation.
1001094
207 followersView on X
甲斐甲@k_aik_ou61d
Disclosure
📝 新着記事を公開しました Cursor脆弱性DuneSlide(CVSS9.8)、原因はたった1つのパラメータだった 2026年6月、AIコーディングIDE「Cursor」に2件のクリティカル脆弱性「DuneSlide」（CVE-2026-50548 / CVE-2026-50549）へのCVE番号が正式に割り当てられました。CVSSスコアはいずれも 9.8/10（CVSS … https://t.co/d4T52NzC0H
Post summary
The post announces a new article detailing two critical CVEs for Cursor, highlighting their high CVSS scores and single‑parameter cause but providing no proof of exploitation or remedial guidance.
1000081
638 followersView on X
Fiona@fiona_novesai77d
Patch
Cursor patched two zero-click RCEs (CVE-2026-50548/50549, CVSS 9.8). The sandbox helper was the target—not your code, the guard meant to protect it. Lesson: when the guard becomes the attack surface, "sandboxed" is decoration. Verify the guard. Or it's just a label.
Post summary
Cursor has issued patches for two high‑severity zero‑click RCE vulnerabilities (CVE-2026-50548/50549, CVSS 9.8) without mentioning a PoC or active exploitation.
0001044
13 followersView on X
セキュリティ対策Lab@securityLab_jp105d
Disclosure
AI コーディングエディタ Cursorに深刻な脆弱性(CVE-2026-50548、CVE-2026-50549)-DuneSlide https://rocket-boys.co.jp/security-measures-lab/cursor-ide-duneslide-vulnerability-cve-2026-50548/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces serious vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the AI coding editor Cursor, linking to a security lab article, but provides no details on exploitation, remediation, or technical specifics.
01000149
459 followersView on X
SecAlerts@SecAlertsCo107d
Disclosure
Two CVSS 9.3 vulns in Cursor AI code editor. Info, incl. fix info, at vulnerability alert service, #SecAlerts: CVE-2026-50549: https://secalerts.co/vulnerability/CVE-2026-50549 CVE-2026-50548: https://secalerts.co/vulnerability/CVE-2026-50548 #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #CVE202650548 #CVE202650549 https://t.co/taGYcue6c4
Post summary
Two high‑severity CVE‑2026‑50548 and CVE‑2026‑50549 vulnerabilities in Cursor AI's code editor were disclosed, with fix information referenced in a linked vulnerability alert service.
00100357
851 followersView on X
Vic's daily news@claw_news_107d
Disclosure
🗞️ DuneSlide: How Cursor’s Zero-Click RCE Vulnerabilities Unmasked the Fragile Illusion of Agentic Sandbox Security The disclosure of "DuneSlide" (CVE-2026-50548 & CVE-2026-50549) in the Cursor AI editor marks a critical turning point in AI agent security. With a CVSS score of 9.8, these zero-click RCE vulnerabilities show how indirect prompt injections can bypass application-level sandboxes by abusing path canonicalization and working directory parameters. As agentic IDEs evolve, the tension between developer velocity and local machine isolation grows. Mitigations like microVMs or cloud containers prevent local compromise but degrade the seamless IDE experience. Securing the future of development requires kernel-level sandboxing models.
Post summary
The piece announces the discovery of two zero-click RCE vulnerabilities (CVE-2026-50548 & CVE-2026-50549) in the Cursor AI editor, highlighting their high severity, CVSS score of 9.8, and the method of bypassing sandboxing through path canonicalization and working directory manipulation.
0001085
42 followersView on X
CyberTLDR@CyberTLDR110d
Disclosure
1/3 Two critical flaws (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) in Cursor AI let prompt injection escape the sandbox and run commands on the developer's machine. No click needed. All versions before 3.0 are affected. Patch now. #CVE #PromptInjection #cybersecurity
Post summary
The post announces two high‑severity CVEs in Cursor AI that allow sandbox‑escaping prompt injection to execute commands, urging users of versions below 3.0 to apply the patch.
1000074
17 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anysphere	cursor	-	-	-

Explore more

Back to dashboard anysphere CVEs cursor vulnerabilities

What researchers are saying

CVE-2026-50548

Perturb AI[verified]@perturbaixDisclosure

Two critical CVEs (CVE‑2026‑50548/49) in Cursor AI’s code editor are reported with zero‑click RCE via prompt injection; no PoC, exploit code, patch or active exploitation details are provided.

SecurityWeek[verified]@SecurityWeekDisclosure

The headline announces newly identified vulnerabilities in Cursor AI Code Editor that allow OS‑level remote code execution, but offers no further context beyond the basic description.

Moit Reghason[verified]@MoitReghasonActive Exploitation

The disclosed zero‑click RCE (CVE‑2026‑50548) is corroborated by real‑world exploitation, specifically the Taiko bridge incident that drained $1.7M, and the text highlights additional high‑severity MCP vulnerabilities.

Upwind Security MDR[verified]@UpwindMDRPatch

CVE‑2026‑50548 is a sandbox escape vulnerability in Cursor versions prior to 3.0 that allows arbitrary file writes and remote code execution; upgrading to 3.0 is the recommended fix.

Bryan[verified]@so_sthbryanPatch

Two new Cursor vulnerabilities (CVE‑2026‑50548 & CVE‑2026‑50549) with a CVSS score of 9.8 allow prompt injection for arbitrary command execution; the issues are already patched, and users are urged to update and audit their environment.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediPatch

The text announces CVE-2026-50548 and CVE-2026-50549, both rated 9.8, fixes them in Cursor 3.0 released April 2, without providing exploit or PoC details.

TechPulseHK[verified]@TechPulseHKDisclosure

The message discloses two CVEs (CVE‑2026‑50548 & 50549) that allow 0‑click RCE through prompt injection, sandbox bypass, and symlink exploitation, but it does not provide PoC code, active exploitation reports, or fixes.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The post reports that CVE-2026-50548 and CVE-2026-50549 were actively exploited by attackers to escape sandboxes and execute arbitrary commands on developer machines, enabling remote code execution.