CVE-2026-50548: 
NixOS vulnerability analysis and mitigation

CVE-2026-50548 is a sandbox escape vulnerability in Cursor, the AI-powered code editor developed by Anysphere, that allows a malicious AI agent to write arbitrary files outside the intended workspace and achieve non-sandboxed Remote Code Execution (RCE). The flaw exists in all Cursor Desktop versions prior to 3.0 and was disclosed on June 25, 2026, with a patch released in version 3.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly). The vulnerability was discovered and reported by Cato AI Labs, who dubbed the related research campaign "DuneSlide" (Cato Networks).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / Path Traversal) in how Cursor's agent sandbox processes the working_directory parameter. By default, Cursor's agent sandbox grants write access to the command's working directory; however, the sandbox failed to validate or restrict agent-controlled modifications to this parameter, allowing it to be set to arbitrary sensitive filesystem locations outside the workspace (GitHub Advisory). A malicious agent — triggered via a prompt injection attack embedded in content the AI processes — can manipulate working_directory to point to sensitive system paths, causing the sandbox to grant write access to those paths under the user's OS privileges. This can be chained to overwrite the cursorsandbox helper binary itself, causing all subsequent agent terminal commands to execute entirely outside the sandbox with no further user interaction required (Cato Networks, GitHub Advisory).

Successful exploitation grants an attacker full, non-sandboxed code execution on the developer's machine under the user's OS privileges, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive files (source code, credentials, SSH keys, API tokens), overwrite or delete arbitrary files, and establish persistent access — for example by replacing the cursorsandbox helper so all future agent commands run unsandboxed. Because Cursor is widely used by professional developers, including those at Fortune 500 companies, exploitation could serve as a beachhead for supply chain attacks or lateral movement into corporate networks (Cato Networks, Secure Bulletin).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). However, the NVD SSVC assessment marks the vulnerability as "Automatable" with "Total" technical impact, reflecting the low attack complexity and zero required privileges or user interaction beyond a benign prompt. The EPSS score is approximately 0.52%, indicating a currently low but non-trivial probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is particularly notable because it can be triggered via prompt injection — malicious instructions embedded in files, web pages, or other content that the AI agent processes — making it a zero-click RCE vector from the user's perspective (GitHub Advisory, The Hacker News).

1. Craft a malicious prompt injection payload: Embed adversarial instructions into content the Cursor AI agent will process — such as a README file, a code comment, a web page fetched during a task, or a dependency file. The payload instructs the agent to modify the working_directory parameter to a sensitive system path (e.g., the directory containing the cursorsandbox helper binary).
2. Trigger agent processing: Cause the victim developer to open or process the malicious content in Cursor's agent mode. No explicit user approval of the malicious action is required — the agent interprets the injected instructions as legitimate task steps.
3. Abuse the sandbox working directory flaw: The agent sets working_directory to the attacker-chosen sensitive path. The Cursor sandbox, failing to validate this parameter, grants write access to that path as if it were the legitimate workspace.
4. Write a malicious file: The agent writes an attacker-controlled file to the sensitive location — for example, replacing the cursorsandbox helper binary with a malicious executable or script.
5. Achieve persistent non-sandboxed RCE: All subsequent agent terminal commands now execute through the compromised cursorsandbox helper, running entirely outside the sandbox under the user's OS privileges. The attacker can exfiltrate data, establish persistence, or pivot to other systems on the network (GitHub Advisory, Cato Networks, The Hacker News).

• File System: Unexpected modification timestamp or content change on the cursorsandbox helper binary; new or modified files in sensitive system directories (e.g., /usr/local/bin/, ~/.config/, application support directories) created by the Cursor process; unexpected scripts or executables written outside the project workspace directory.
• Process: Cursor agent spawning child processes (shells, interpreters, network tools such as curl, wget, python, bash) that execute outside the expected workspace context; processes running under the user account that were not explicitly initiated by the user.
• Logs: Cursor application logs showing working_directory values set to paths outside the project workspace; OS audit logs (e.g., auditd on Linux, Unified Logging on macOS) recording file write events to sensitive paths by the Cursor process.
• Network: Unexpected outbound network connections from the Cursor process or its child processes to external IP addresses or domains, particularly shortly after agent task execution (Cato Networks, GitHub Advisory).

The primary remediation is to update Cursor to version 3.0 or later, in which the sandbox no longer grants write access based on an agent-controlled working_directory parameter (GitHub Advisory). Until patching is possible, organizations should avoid using Cursor's agent terminal feature with untrusted inputs, including opening untrusted repositories, processing external files, or allowing the agent to fetch content from the web. Developers should also apply the principle of least privilege to their OS user accounts to limit the blast radius of any exploitation.

The vulnerability received significant coverage across the security community following its disclosure. Cato AI Labs, the discovering team, published a detailed technical blog post naming the research "DuneSlide" and highlighting the broader risk of prompt injection as an RCE vector in AI-powered IDEs (Cato Networks). The Hacker News, SecurityWeek, CSO Online, and GBHackers all covered the story, emphasizing the zero-click nature of the attack and its implications for developer supply chain security (The Hacker News, SecurityWeek, CSO Online). Community discussion on Reddit's r/netsec and r/pwnhub highlighted concerns about the growing attack surface introduced by AI agents with filesystem and terminal access, with many researchers noting this as a landmark case for prompt injection achieving OS-level RCE (Reddit r/netsec).