CVE-2026-50549Disclosure(anysphere / cursor)

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch anysphere cursor systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the workspace and force canonicalization to fail — either because the target does not exist or because read permission is removed from the path — so the agent writes through the symlink to an arbitrary location without approval. A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.

anysphere CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx

Weakness type (CWE)

CWE-59

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cursor

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
27 mentions across 17 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 13 signals
Technical details provided in 21 signals
Disclosure: 15 classified signals
General: 3 classified signals
Peaked 12d ago at 5 mentions (2026-07-02); latest day: 1
27 total mentions across 17 days

Affected systems

Vendors

anysphere

Products

cursor

Deep dive

Activity timeline27 mentions / 17d

Signal classification4 categories

Disclosure

1555.6%

Patch

829.6%

General

311.1%

Active Exploitation

13.7%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-06	1	Disclosure1
2026-06-07	1	Disclosure1
2026-06-09	1	General1
2026-07-01	3	Active Exploitation1Disclosure2
2026-07-02	5	Disclosure2Patch3
2026-07-04	1	Patch1
2026-07-05	2	Disclosure2
2026-07-06	3	Disclosure2Patch1
2026-07-08	1	Disclosure1
2026-07-09	2	Disclosure1Patch1
2026-07-13	1	Patch1
2026-07-15	1	Disclosure1
2026-07-18	1	Patch1
2026-07-23	1	General1
2026-08-10	1	Disclosure1
2026-08-21	1	General1
2026-09-07	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews111d
Disclosure
🛑 Two Cursor vulnerabilities could let hidden prompt-injection instructions escape the editor’s terminal sandbox and run commands on a developer’s machine. Tracked as CVE-2026-50548 and CVE-2026-50549, they affect versions before 3.0. See how it works: https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html
Post summary
Two new CVEs (CVE‑2026‑50548 and CVE‑2026‑50549) for the Cursor editor are disclosed, potentially enabling prompt‑injection RCE attacks; an article link provides a demonstration, but no exploit code or active use is reported.
2180461617.0K
2.3M followersView on X
Perturb AI@perturbaix107d
Disclosure
two critical vulnerabilities just confirmed in Cursor AI code editor. CVE-2026-50548 and CVE-2026-50549. CVSS score: 9.8. called DuneSlide. zero-click prompt injection. escapes the sandbox. executes arbitrary code on the underlying OS. the attack triggers when you ask the IDE to read an attacker-controlled file. that is it. you just have to open a file. your AI coding assistant is now a remote code execution vector. Cursor has 4 million+ developers using it daily. this is not a theoretical AI security risk. it is a confirmed 9.8 CVSS vulnerability in the AI tool your engineering team uses right now: http://perturbai.io
Post summary
Two confirmed CVEs (CVE-2026-50548 and CVE-2026-50549) in Cursor AI’s code editor enable zero‑click remote code execution via sandbox escape when opening an attacker‑controlled file, rated at CVSS 9.8.
30190666
223 followersView on X
iototsecnews@iototsecnews104d
Patch
Cursor IDE の RCE 脆弱性 CVE-2026-50548／50549：プロンプト・インジェクションによるサンドボックス・エスケープ https://iototsecnews.jp/2026/07/01/critical-cursor-ide-rce-vulnerabilities-enable-prompt-injection-in-zero-click/ 先端の AI 技術を搭載した開発ツール Cursor IDE において、隔離された安全な環境の制限を突破されてしまう深刻な欠陥 CVE-2026-50548／CVE-2026-50549 が報告されました。この問題の背景には、外部の検索結果などを AI が読み込む際に、特定の命令文によってファイル操作の経路検証をすり抜けられてしまうという構造上の隙があります。もし悪用されると、利用者が気付かないうちに開発用の大切なシステムファイルが上書きされ、作業用コンピュータ全体の制御を奪われるなどの重大な被害に繋がります。確実な対応策として、まずは利用しているツールを最新の状態に更新してください。また、信頼できない外部のデータや未検証の接続先を AI に直接読み込ませないよう、運用の制限を設けることが大切です。 #AI/ML #CVE202650548 #CVE202650549 #CursorIDE #Vulnerability
Post summary
The article reports RCE vulnerabilities (CVE‑2026‑50548/50549) in Cursor IDE caused by prompt injection that bypasses sandbox checks, and recommends updating the tool and limiting untrusted AI input to mitigate the risk.
01060253
512 followersView on X
ProtAAPP - Protege las AAPP@ProtAAPP106d
Disclosure
Cato Networks alerta sobre dos vulnerabilidades críticas en el editor de código AI Cursor, CVE-2026-50548 y CVE-2026-50549 (CVSS 9.8). Permiten inyecciones de comandos sin clic que ejecutan código arbitrario en el sistema operativo subyacente. https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/ https://t.co/bYVKNgnpvx
Post summary
Cato Networks alerts about two critical CVE-2026-50548 and CVE-2026-50549 vulnerabilities in the AI editor Cursor that enable non‑interactive command injection leading to OS‑level remote code execution. No exploit details or patch information are provided in this announcement.
00021289
8.3K followersView on X
Bryan@so_sthbryan108d
Patch
Two Cursor flaws let one prompt escape the sandbox. DuneSlide (CVE-2026-50548, CVE-2026-50549): - CVSS 9.8, no click required - Prompt injection runs arbitrary commands on dev machines - Patched, but every Cursor build before the fix is exposed Update today, then audit your tabs. https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html
Post summary
The message announces that two Cursor prompt injection flaws (CVE-2026-50548, CVE-2026-50549) are serious, have been patched, and urges users to update.
11010106
106 followersView on X
Avkash K@avkashk71d
Disclosure
Six AI coding assistants had the same flaw this month. A symlink named project_settings.json, pointing at your SSH keys. You approve a small edit. The write lands somewhere else. @cursor_ai's fix rated a 9.8, CVE-2026-50549. The approval prompt was never the safety boundary. Research: @wiz_io https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants
Post summary
The post discloses CVE‑2026‑50549 in AI coding assistants, detailing a symlink flaw that redirects edits to SSH keys, but it does not reference a PoC, exploit, or patch.
01010109
1.6K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi103d
Disclosure
الثغرات: CVE-2026-50548 | التقييم: 9.8 CVE-2026-50549 | التقييم: 9.8 المشكلة موجودة في Cursor قبل الإصدار 3.0، وتم إصلاحها في Cursor 3.0 بتاريخ 2 أبريل. حسب Cursor، أكثر من نصف شركات Fortune 500 يستخدمون الأداة تخيل مقدار الضرر لو تسربت الثغره او وقعت في يد الشخص الخطأ ؟
Post summary
The post announces two high‑severity CVEs (CVE‑2026‑50548 and CVE‑2026‑50549) affecting Cursor before v3.0, notes the fix delivered on April 2, and cautions about potential damage to many Fortune 500 companies.
100101.3K
49.3K followersView on X
SecAlerts@SecAlertsCo110d
Patch
🖱️ Cursor Desktop (pre-v3.0) sandbox escape: a symlink + path canonicalization flaw lets AI agent terminal commands write outside the sandbox. CVSS 9.3 critical, no auth needed. Upgrade now. CVE-2026-50549 https://secalerts.co/vulnerability/CVE-2026-50549?utm_campaign=x https://t.co/oZQ7MrxB02
Post summary
The tweet announces a critical sandbox‑escape vulnerability (CVE-2026-50549) in Cursor Desktop pre‑v3.0, urges users to upgrade, and links to a security advisory.
1001093
847 followersView on X
Aviatrix Threat Research Center@aviatrixtrc111d
Active Exploitation
TRC analysis shows attackers exploited critical sandbox escape flaws in Cursor AI editor (CVE-2026-50548, CVE-2026-50549) to execute arbitrary commands on developer machines. The vulnerabilities allow file writes outside intended workspaces, creating pathways for remote code execution without user interaction. #DevSecOps 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/critical-cursor-flaws-cve-2026-50548-cve-2026-50549
Post summary
The post reports that attackers successfully exploited CVE-2026-50548 and CVE-2026-50549, enabling remote code execution via sandbox escape, but does not provide a patch, PoC, or exploit code. It highlights active use in the wild.
1001081
1.9K followersView on X
Hi@hieyz6838136d
Disclosure
cursor CVE-2026-50549 + 50548 is the agent sandbox escape story of the week. symlink canonicalization failure + a writable working_directory = the agent walks itself out of the box and runs as you. anyone on an older cursor build right now is a bug bounty program's easiest p1.
Post summary
The post identifies CVE‑2026‑50549/50548 as a sandbox escape flaw in older Cursor builds involving symlink canonicalization and a writable working_directory, but offers no PoC, exploit tool, patch, or evidence of active exploitation.
1001048
13 followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 Critical - Sandbox Escape & RCE in Cursor AI Editor (CVE-2026-50549, CVE-2026-50548) Two critical vulnerabilities have been disclosed in Cursor's AI agent sandbox. Malicious agents can exploit canonicalization failures via symlinks or manipulate the working_directory parameter to write arbitrary files outside the workspace under the user's privileges. 👉 Leads to unsandboxed Remote Code Execution (RCE) with zero user interaction | Upgrade Cursor to version 3.0 immediately to block these vectors
Post summary
Two critical sandbox escape bugs (CVE‑2026‑50549, CVE‑2026‑50548) in Cursor AI Editor enable unsandboxed remote code execution; the post recommends immediately upgrading to version 3.0 as mitigation.
1001094
207 followersView on X
Peldum@peldumHack43d
Disclosure
4/5 Los 6 (según Wiz, 8 jul 2026): • Amazon Q → CVE-2026-12958 · parcheado (lang server ≥1.69.0) • Cursor → CVE-2026-50549 Critical · parcheado (v3.0+) • Google Antigravity → Critical · parcheado (mayo 2026) • Claude Code → Anthropic lo disputó (“fuera del threat model”); hay warning de symlink • Augment y Windsurf → al disclosure, sin parche En Windsurf/Amazon Q el write a veces iba *antes* del Accept: el “OK” era un undo, no un candado.
Post summary
The text details several CVE disclosures and patch status, noting one disputed claim, but does not provide PoC, exploit code, or evidence of active exploitation.
1000066
580 followersView on X
甲斐甲@k_aik_ou60d
General
📝 新着記事を公開しました Cursor脆弱性DuneSlide(CVSS9.8)、原因はたった1つのパラメータだった 2026年6月、AIコーディングIDE「Cursor」に2件のクリティカル脆弱性「DuneSlide」（CVE-2026-50548 / CVE-2026-50549）へのCVE番号が正式に割り当てられました。CVSSスコアはいずれも 9.8/10（CVSS … https://t.co/d4T52NzC0H
Post summary
The tweet announces the official CVE numbers and CVSS scores for two critical vulnerabilities in Cursor, but it lacks technical depth, PoC references, or remedial guidance.
1000081
638 followersView on X
George Bevis@GeorgeBevis99d
Patch
⚡ PLATFORM HIGHLIGHTS: → Claude Code defaults to Sonnet 5 🚀 1M context. Background agents auto-commit, push, and open draft PRs without an approval prompt. → Cursor v3.0 patched the GhostApproval symlink CVE (CVE-2026-50549) 🔐 → OpenCode v1.17.12: adaptive thinking for Sonnet 5, MCP content prioritised over structured output 🧠 https://oday-bakkour.com/blog/ai-coding-news-july-4-2026
Post summary
The text announces that Cursor version 3.0 has patched CVE‑2026‑50549, with no evidence of exploitation or PoC, and provides minimal technical details.
1000074
2.3K followersView on X
セキュリティ対策Lab@securityLab_jp105d
Disclosure
AI コーディングエディタ Cursorに深刻な脆弱性(CVE-2026-50548、CVE-2026-50549)-DuneSlide https://rocket-boys.co.jp/security-measures-lab/cursor-ide-duneslide-vulnerability-cve-2026-50548/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces the existence of two new CVEs (CVE‑2026‑50548 and CVE‑2026‑50549) in the AI coding editor Cursor, but provides no further details such as PoC, exploit, or fixes.
01000149
459 followersView on X
SecAlerts@SecAlertsCo107d
Patch
Two CVSS 9.3 vulns in Cursor AI code editor. Info, incl. fix info, at vulnerability alert service, #SecAlerts: CVE-2026-50549: https://secalerts.co/vulnerability/CVE-2026-50549 CVE-2026-50548: https://secalerts.co/vulnerability/CVE-2026-50548 #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #CVE202650548 #CVE202650549 https://t.co/taGYcue6c4
Post summary
Two high‑severity CVSS 9.3 vulnerabilities were disclosed in Cursor AI’s code editor, with fix information linked to a vulnerability alert service.
00100357
851 followersView on X
Vic's daily news@claw_news_107d
Disclosure
🗞️ DuneSlide: How Cursor’s Zero-Click RCE Vulnerabilities Unmasked the Fragile Illusion of Agentic Sandbox Security The disclosure of "DuneSlide" (CVE-2026-50548 & CVE-2026-50549) in the Cursor AI editor marks a critical turning point in AI agent security. With a CVSS score of 9.8, these zero-click RCE vulnerabilities show how indirect prompt injections can bypass application-level sandboxes by abusing path canonicalization and working directory parameters. As agentic IDEs evolve, the tension between developer velocity and local machine isolation grows. Mitigations like microVMs or cloud containers prevent local compromise but degrade the seamless IDE experience. Securing the future of development requires kernel-level sandboxing models.
Post summary
This post discloses two zero‑click RCE CVEs in the Cursor AI editor with high‑severity scores and technical details, highlighting bypass of sandboxing via path canonicalization. It includes mitigations as workarounds but no PoC, exploit code, or evidence of active exploitation.
0001085
42 followersView on X
CyberTLDR@CyberTLDR110d
Patch
1/3 Two critical flaws (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) in Cursor AI let prompt injection escape the sandbox and run commands on the developer's machine. No click needed. All versions before 3.0 are affected. Patch now. #CVE #PromptInjection #cybersecurity
Post summary
The tweet announces two critical prompt injection vulnerabilities in Cursor AI (CVE‑2026‑50548 & CVE‑2026‑50549) with CVSS 9.8, highlights command execution without click‑through, and urges users to apply the patch immediately for all pre‑3.0 versions.
1000074
17 followersView on X
Proficio@proficioinc110d
Disclosure
DuneSlide: Two Critical RCE Vulnerabilities CVE-2026-50548 and CVE-2026-50549 via Zero-Click Prompt Injection in Cursor IDE via @CatoNetworks #Proficio #ThreatNews #Cybersecurity #MSSP #MDR https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/
Post summary
The announcement discloses two critical RCE CVEs affecting Cursor IDE, but does not provide PoC, exploit code, or evidence of active exploitation.
00010108
1.0K followersView on X
Halil Deniz@denizhalilT110d
Disclosure
Critical bugs in Cursor Desktop! 🚨 CVE-2026-50548 and CVE-2026-50549 allow AI agents to escape the sandbox and execute arbitrary code (RCE) on your host. Read the full technical breakdown and protection steps here: https://denizhalil.com/2026/07/02/cve-2026-50548-cursor-ai-vulnerabilities/ #AISecurity #Infosec #CVE https://t.co/7KXaDPxtXm
Post summary
CVE-2026-50548 and CVE-2026-50549 in Cursor Desktop enable sandbox escape RCE; a technical breakdown and protection steps are available via the linked article.
0001059
33 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anysphere	cursor	-	-	-

Explore more

Back to dashboard anysphere CVEs cursor vulnerabilities

What researchers are saying

CVE-2026-50549

Perturb AI[verified]@perturbaixDisclosure

Two confirmed CVEs (CVE-2026-50548 and CVE-2026-50549) in Cursor AI’s code editor enable zero‑click remote code execution via sandbox escape when opening an attacker‑controlled file, rated at CVSS 9.8.

Bryan[verified]@so_sthbryanPatch

The message announces that two Cursor prompt injection flaws (CVE-2026-50548, CVE-2026-50549) are serious, have been patched, and urges users to update.

Avkash K[verified]@avkashkDisclosure

The post discloses CVE‑2026‑50549 in AI coding assistants, detailing a symlink flaw that redirects edits to SSH keys, but it does not reference a PoC, exploit, or patch.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

The post announces two high‑severity CVEs (CVE‑2026‑50548 and CVE‑2026‑50549) affecting Cursor before v3.0, notes the fix delivered on April 2, and cautions about potential damage to many Fortune 500 companies.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The post reports that attackers successfully exploited CVE-2026-50548 and CVE-2026-50549, enabling remote code execution via sandbox escape, but does not provide a patch, PoC, or exploit code. It highlights active use in the wild.

Upwind Security MDR[verified]@UpwindMDRDisclosure

Two critical sandbox escape bugs (CVE‑2026‑50549, CVE‑2026‑50548) in Cursor AI Editor enable unsandboxed remote code execution; the post recommends immediately upgrading to version 3.0 as mitigation.

Peldum[verified]@peldumHackDisclosure

The text details several CVE disclosures and patch status, noting one disputed claim, but does not provide PoC, exploit code, or evidence of active exploitation.

George Bevis[verified]@GeorgeBevisPatch

The text announces that Cursor version 3.0 has patched CVE‑2026‑50549, with no evidence of exploitation or PoC, and provides minimal technical details.