CVE-2026-50549: Anysphere Cursor Link Following Flaw Allows Out-of-Workspace File Writes
Anysphere Cursor versions before 3.0 can write files outside the workspace when path canonicalization fails, because the agent falls back to the original path without approval. NVD assigns CVSS 3.1 9.8 and the GitHub CNA assigns CVSS 4.0 9.3, and the record describes possible non-sandboxed remote code execution. The record states the fix is in 3.0 and does not list the CVE in CISA KEV.
Overview
Cursor is a code editor built for AI-assisted programming. According to the record, versions before 3.0 run agent terminal commands in a sandbox by default, but a weakness in the file write flow can let an agent write outside the workspace without approval. The weakness is classified as CWE-59 (Link Following).
Impact
- Arbitrary file writes outside the workspace, under the privileges of the user running Cursor.
- The record describes possible non-sandboxed remote code execution, for example by overwriting a sandbox helper so later commands run outside the sandbox.
- The record states that no user interaction is needed beyond a benign prompt.
Affected products and versions
- Anysphere Cursor versions before 3.0, as listed in the record.
- The record description states the issue is fixed in 3.0. The fixes list in the record is empty, so any specific fixed build identifier is unknown.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade Cursor to version 3.0 or later, as stated by the record.
- Until upgraded, be cautious when running agents against untrusted repositories and review approval prompts before accepting write operations.
- Limit the privileges of the operating system account used for Cursor so that a successful write has a smaller reach.
Detection guidance
- Review file modifications made by the editor process outside project directories, with particular attention to sandbox helper components.
- Monitor for unexpected changes to Cursor installation files and for agent-initiated commands that appear to run outside the expected sandbox.
Limitations of the available information
The record provides the description, CVSS scores from NVD and GitHub, and one vendor advisory reference. It does not provide an EPSS score, SSVC data, KEV details, a fixed build identifier, or vendor patch notes beyond the description.
Frequently asked questions
Which Cursor versions are affected by CVE-2026-50549?
The record lists Anysphere Cursor versions before 3.0 as affected. The description states the vulnerability is fixed in 3.0.
Is this CVE known to be exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Why is the CVSS score high?
NVD assigns CVSS 3.1 9.8 and the GitHub CNA assigns CVSS 4.0 9.3. The record describes possible arbitrary file writes outside the workspace and possible non-sandboxed code execution.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.