CVE-2026-50548: Cursor Path Traversal in Agent Sandbox Working Directory
CVE-2026-50548 is a path traversal weakness (CWE-22) in Cursor versions before 3.0, where the sandbox used for agent terminal commands can include writable paths outside the intended workspace. According to the record, this could let a malicious agent write files outside the workspace with the user's privileges and lead to non-sandboxed remote code execution. NVD scores it CVSS 3.1 9.8 (Critical), the record says it is fixed in 3.0, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-50548 is a path traversal weakness (CWE-22) in Cursor, an AI-assisted code editor. According to the record, the flaw affects versions before 3.0 and concerns how the sandbox for agent terminal commands determines writable locations.
Impact
The record states that a malicious agent could direct the sandbox's writable scope to a sensitive location outside the workspace and write files there with the user's privileges. It further states this can enable non-sandboxed remote code execution. NVD assigns CVSS 3.1 with a score of 9.8 (Critical), and the GitHub CNA lists CVSS 4.0 with a score of 9.3.
Affected products and versions
- Product: Anysphere Cursor
- Affected range in the record: versions less than 3.0
- The record states the vulnerability is fixed in 3.0. The record does not include a separate list of fixed builds.
Exploitation status
CISA KEV does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. EPSS data is not available in the record.
Remediation and mitigation
- Upgrade Cursor to version 3.0 or later, consistent with the record's statement that the flaw is fixed in 3.0.
- Until the upgrade is applied, limit agent autonomy and review terminal commands and working directory changes before approving them.
- Check the integrity of the sandbox helper and of files in sensitive locations for unexpected changes.
- Consult the vendor advisory for official guidance: GHSA-3p48-7v9f-v5cw
Detection guidance
- Monitor for unexpected writes by the editor or agent processes outside the project workspace, especially to user profile areas, shell configuration files or helper binaries.
- Audit agent-initiated terminal activity and unusual changes to working directory settings.
- Watch for commands that appear to run without sandbox restrictions after agent activity.
Limitations of the available information
The record does not provide a detailed technical root cause or a list of fixed builds beyond the statement that 3.0 contains the fix. It does not confirm real-world exploitation. The CVSS 3.1 and 4.0 scores come from different providers. The record does not state whether the benign prompt it mentions can be avoided.
Frequently asked questions
Which Cursor versions are affected by CVE-2026-50548?
The record lists Anysphere Cursor versions less than 3.0 as affected and states the vulnerability is fixed in 3.0.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.
What should defenders do first?
Upgrade Cursor to 3.0 or later, limit agent autonomy until the upgrade is applied, and monitor for unexpected file writes outside the project workspace.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.