CVE-2026-50549

Cursor path-resolution failure allows sandbox-escaping writes

Cursor · Cursor Desktop

First documented disclosure · Review checkpoint

Summary

A path-validation fallback lets the agent write outside its workspace without approval.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Failed canonicalization falls back to the original path, permitting writes through a symlink.

Conditions required

Attacker influence over agent behavior and a path whose resolution fails.

Potential impact

Arbitrary file writes under the user’s privileges, potentially leading to unsandboxed code execution.

Affected versions and configurations

Cursor before 3.0.

Fix and mitigation status

Cursor 3.0.

Practical next steps

Install a supported release containing the 3.0 fix; treat unresolved paths as denied.

Operating lesson

File-boundary checks must fail closed when the real destination cannot be resolved.

Evidence and limits

Maintainer advisory June 5 predates CNA publication June 25 and GhostApproval July 8. The broader GhostApproval claims include disputed Anthropic behavior and should not be generalized to this patched Cursor CVE.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources