Cursor sandbox escape via symlink and failed path canonicalization fallback (CVE-2026-50549)
In Cursor versions before 3.0, a write target's path was canonicalized to confirm it remained inside the workspace, and a canonicalization failure fell back to the original, unresolved path and wrote without approval. An in workspace symlink pointing outside the workspace, with resolution forced to fail, could reach that fallback. Disclosed by Cursor and credited to Cato AI Labs on 5 June 2026, patched in 3.0, with no evidence of exploitation in the wild found by this record.
Affected
- Organisation
- Cursor (Anysphere)
- Product
- Cursor (agent sandbox: path canonicalization)
- Component
- Write target path canonicalization check ahead of the terminal sandbox's workspace scope enforcement
- Versions
- Cursor before 3.0; fixed in 3.0
- Configurations
- Default sandboxed terminal command execution
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- An AI coding agent writing files inside Cursor's default sandbox
- Agent
- Cursor Agent
- Delegating actor
- unknown
- Action
- Created an in workspace symlink pointing outside the workspace, then caused Cursor's own path canonicalization check to fail, so the write proceeded against the symlink's original, unresolved, apparent path rather than being rejected
- Target resource
- The external location the symlink pointed at, up to overwriting the cursorsandbox helper per Cursor's own advisory
- Environment
- The user's own machine running Cursor's default sandboxed terminal tool
- Credentials used
- unknown
- Privileges available
- The user's own account privileges, once the cursorsandbox helper itself was overwritten
- Authority presented
- A write against a path that appeared, syntactically, to sit inside the workspace
- Authority required
- Authority over the effective, resolved target the path actually pointed at
- Applicable policy
- Cursor's own check that a write target's canonicalized path remains inside the workspace before the write proceeds
- Approval mechanism
- unknown
- Required approver
- unknown
- Independent approval
- no
- Action binding
- A canonicalization failure was treated as equivalent to the path it failed to resolve, rather than as a rejection, so a target the system could not verify inherited that path's apparent trust
- Sequence context
- Cato AI Labs describes zero click prompt injection, content the agent reads on a user's behalf such as an MCP response or a web search result, as one path by which the agent could create the symlink and force the resolution failure with no user action beyond a benign prompt
Impact
- Consequence
- Arbitrary file writes outside the workspace under the user's own privileges, extending to non sandboxed remote code execution by overwriting the cursorsandbox helper, per Cursor's own advisory
- Reach
- single
- Reversibility
- unknown
- Detectability
- silent
- Propagation
- potential
- Recovery
- Fixed by treating a canonicalization failure as untrusted and blocking the write; no way described to reverse a write or a helper overwrite already made before the patch
Evidence
Primary sources
- Cursor Desktop sandbox escape via symlink and failed path canonicalization (CVE-2026-50549) (Cursor (Anysphere))
Supporting sources
- DuneSlide: Two Critical RCE vulnerabilities via Zero-Click Prompt Injection in Cursor IDE (Cato Networks)
- Reproduction status
- Confirmed directly in Cursor's own advisory, credited to Cato AI Labs. A demonstrated zero click exploit chain is described in corroborated reporting on Cato AI Labs' own DuneSlide research, not read directly from Cato's own page in this session.
- Evidence state
- Confirmed
Known unknowns
- Whether the flaw was triggered against a real deployment before the fix shipped, beyond Cato AI Labs' own demonstrated research.
- The exact date Cursor 3.0 itself shipped was not independently confirmed from a source this record could read directly.
Limitations
- Cato Networks' own DuneSlide article could not be fetched directly in this session; its account is corroborated through multiple independently phrased web searches converging on consistent detail across named independent outlets, not through a direct read of Cato's own page.
- Neither GHSA advisory for this discovery backfill publishes a numeric CVSS score or a CWE classification; a CVSS score of 9.8 is reported consistently in corroborating search results but is not confirmed from Cursor's own advisory text.
Claim provenance
- verified
Cursor's own advisory, fetched directly, states the mechanism, assigns CVE-2026-50549, records the affected and fixed versions, and credits Cato AI Labs.
The Sandbox Asked the Agent Where the Boundary Should Be. - independent-reporting
Cato AI Labs' own DuneSlide research names the zero click prompt injection delivery path and the cursorsandbox overwrite chain. Cato's own site could not be fetched directly in this session; this basis rests on corroborated search reporting rather than a direct read.
The Sandbox Asked the Agent Where the Boundary Should Be.
Protocol evidence
Published authority architectures whose artifacts bear on the requirement this vulnerability exposes: which satisfy it, which expose a way past it, and which leave it unanswered.
- Supports requirement
Agent Control Standard (ACS)
OWASP GenAI Security Project, originally Zenity
Requirement The default posture when no decision arrives in time is to proceed, not to block
Cursor is not an ACS implementation, and this link does not claim it is. ACS's specification states its own fail open tradeoff in decision handling directly, defaulting to proceed rather than block unless a deployment opts into failing closed. Cursor's own advisory for CVE-2026-50549, read directly, shows the identical tradeoff realised at a filesystem resource identity boundary rather than an unreachable Guardian decision: a failed path canonicalization defaulted to proceeding on the original, unresolved path rather than blocking the write, and Cursor's own fix in 3.0 is exactly the opt into failing closed ACS's specification names as the alternative. This is vendor patched, real world evidence for the same risk ACS's specification already states in its own words, at a boundary the specification's own text does not itself address.