Loading vulnerability…
Cursor symlink canonicalization sandbox escape RCE
CVE-2026-50549 is a critical vulnerability in Cursor versions prior to 3.0 that affects the agent write path used by the IDE’s AI-assisted workflow. Before performing a write, Cursor canonicalizes the requested target path to verify that the resolved destination remains داخل the workspace boundary. If canonicalization fails, however, the implementation falls back to the original unresolved path and proceeds with the write without requiring approval. An attacker controlling agent input can exploit this by creating a symlink inside the workspace that points to a location outside the workspace and then forcing canonicalization to fail, such as by targeting a non-existent destination or removing read permission from part of the path. Because the fallback trusts the in-workspace symlink path rather than the real resolved destination, Cursor can be induced to write arbitrary files outside the workspace under the user’s privileges. This flaw enables sandbox escape and can be chained into operating-system-level remote code execution by modifying components used to enforce Cursor’s sandbox so that subsequent commands execute unsandboxed. The issue is fixed in Cursor 3.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary file writes outside the intended workspace boundary with the privileges of the logged-in user. This breaks Cursor’s sandbox assumptions and can be used to overwrite security-relevant binaries, shell startup files, or other sensitive user-writable targets. In practical attack chains, the vulnerability enables sandbox escape, persistence, unauthorized modification of local configuration, and non-sandboxed remote code execution on the host operating system. Depending on the developer environment, compromise can also expose source code, credentials, local secrets, and access to connected development or SaaS resources available to the user account.
If you can’t patch tonight, do this now.
Until patched, avoid running Cursor agents against untrusted repositories, untrusted MCP-connected content, or other attacker-influenced inputs that can drive agent file operations. Restrict agent permissions where possible, isolate development activity in disposable environments, and monitor for unexpected writes outside the workspace, especially modifications to sandbox-related helpers, shell initialization files, and other persistence-relevant locations. Defensive controls should ensure symlinks are resolved before approval is shown and that any operation resolving outside the workspace is blocked or prominently warned.
Patch, then assume compromise.
Upgrade Cursor to version 3.0 or later, which fixes the vulnerable path validation and symlink handling logic. The write path should resolve and validate the final canonical destination before any approval or write occurs, and writes should be denied rather than allowed when canonicalization fails. Security-sensitive helper components and sandbox enforcement artifacts should be restored from a trusted installation after patching if compromise is suspected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.