Loading vulnerability…
DuneSlide Working Directory Sandbox Escape in Cursor
CVE-2026-50548 is a critical path traversal and sandbox-escape vulnerability in Cursor versions prior to 3.0. Cursor’s agent terminal-command sandbox grants write access to the command working directory. An agent-controlled working_directory parameter could be set to a location outside the intended workspace, causing that external location to be included in the sandbox write policy. This enables arbitrary file writes outside the workspace with the privileges of the logged-in user. An attacker can use the out-of-bounds write to replace a sandbox component or modify other sensitive files, causing subsequent agent commands to execute outside the sandbox.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits an attacker to escape Cursor’s intended workspace and terminal sandbox, write arbitrary files as the current user, and obtain unsandboxed code execution. This can result in full compromise of the developer workstation, including modification of user configuration or persistence mechanisms and access to source code, credentials, environment variables, and resources reachable through authenticated development or SaaS sessions.
If you can’t patch tonight, do this now.
Until all installations are upgraded, do not allow Cursor agents to process untrusted prompts or externally sourced content, including content retrieved through agent-connected services and web search. Restrict or disable autonomous terminal-command execution where feasible, limit agent filesystem permissions to dedicated non-sensitive workspaces, and monitor for unexpected writes outside project directories or modifications affecting Cursor sandboxing and startup-related components.
Patch, then assume compromise.
Upgrade Cursor to version 3.0 or later. Version 3.0 corrects handling of the working_directory parameter by enforcing access controls that prevent agent-selected working directories from expanding writable sandbox scope beyond the authorized workspace.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.