CVE-2026-50549— Cursor Desktop sandbox escape via symlink and failed path canonicalization

Cursor Desktop sandbox escape via symlink and failed path canonicalization

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the workspace and force canonicalization to fail — either because the target does not exist or because read permission is removed from the path — so the agent writes through the symlink to an arbitrary location without approval. A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

在文件访问前对链接解析不恰当(链接跟随)

Cursor 后置链接漏洞

Cursor是Cursor公司的一款深度集成AI的智能代码编辑器。 Cursor 3.0之前版本存在后置链接漏洞，该漏洞源于规范化处理失败时回退到原始路径并未经批准写入，可能导致恶意代理在用户权限下写入工作区外的任意文件，实现非沙箱远程代码执行。

N/A

N/A