CVE-2026-50549: 
NixOS vulnerability analysis and mitigation

CVE-2026-50549 is a sandbox escape vulnerability in the Cursor AI code editor (versions prior to 3.0) that allows a malicious agent to write arbitrary files outside the workspace and achieve non-sandboxed Remote Code Execution (RCE). The flaw was discovered by Cato AI Labs researcher Maor Dokhanian and disclosed on June 25, 2026, as part of a pair of critical vulnerabilities dubbed "DuneSlide." It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is improper link resolution before file access (CWE-59), a symlink-following vulnerability combined with a path canonicalization fallback flaw. Cursor's agent terminal sandbox canonicalizes target paths before write operations to ensure they remain within the workspace; however, when canonicalization fails — either because the symlink target does not exist or because read permissions are removed from the path — the agent falls back to the original unresolved path and performs the write without user approval. A malicious agent can exploit this by creating an in-workspace symlink pointing to an arbitrary location outside the workspace, then deliberately causing canonicalization to fail, allowing the write to proceed through the symlink to any location accessible under the user's privileges. This attack requires no user interaction beyond a benign-looking prompt and is classified under CAPEC-132 (Symlink Attack) (GitHub Advisory, Cato Networks).

Successful exploitation allows a malicious agent to write arbitrary files anywhere on the filesystem under the user's privileges, effectively escaping the Cursor sandbox entirely. A concrete attack scenario involves overwriting the cursorsandbox helper binary, causing all subsequent agent terminal commands to execute without sandboxing — achieving full, persistent, non-sandboxed RCE with no further user interaction. This can lead to complete confidentiality, integrity, and availability compromise of the developer's machine, including access to source code, credentials, SSH keys, and the potential for lateral movement within corporate environments (GitHub Advisory, Cato Networks, SecurityWeek).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is rated as automatable by NVD SSVC, meaning exploitation can be scripted without manual interaction. The EPSS score is approximately 0.52%, reflecting a currently low but non-trivial probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack was discovered and responsibly disclosed by Cato AI Labs (researcher Maor Dokhanian) (GitHub Advisory, Cato Networks).

1. Craft a malicious prompt: The attacker delivers a malicious prompt to the Cursor agent (e.g., via a compromised repository, malicious documentation, or prompt injection in a file the agent reads) that instructs it to perform a series of file operations.
2. Create an in-workspace symlink: The agent is instructed to create a symbolic link inside the workspace directory (e.g., workspace/link) that points to a sensitive target outside the workspace (e.g., /usr/local/bin/cursorsandbox or ~/.ssh/authorized_keys).
3. Force canonicalization failure: The agent removes read permissions from the symlink target path or ensures the target does not yet exist, causing Cursor's path canonicalization routine to fail when it attempts to resolve the symlink.
4. Trigger the fallback write: Because canonicalization failed, Cursor falls back to the original (unresolved) path and proceeds with the write operation without user approval, writing attacker-controlled content through the symlink to the arbitrary external location.
5. Achieve persistent RCE: By overwriting the cursorsandbox helper binary with a malicious or unprotected version, all subsequent agent terminal commands execute outside the sandbox under the user's full privileges, enabling persistent code execution, data exfiltration, or further lateral movement (GitHub Advisory, Cato Networks).

• File System: Unexpected symbolic links inside Cursor workspace directories pointing to locations outside the workspace (e.g., /usr/local/bin/, ~/.ssh/, system directories); unexpected modification timestamps on the cursorsandbox helper binary; new or modified files in sensitive system locations with timestamps correlating to Cursor agent activity.
• Process: Cursor agent terminal spawning child processes (shells, interpreters, network tools) without the cursorsandbox wrapper; processes running under the user account that originate from Cursor but access paths outside the workspace.
• Logs: Cursor application logs showing write operations to paths outside the workspace directory; file system audit logs (e.g., auditd on Linux) recording writes to sensitive paths by the Cursor process; permission change events (chmod) on symlink targets immediately before write operations.
• Network: Unexpected outbound connections from the developer machine to external IPs shortly after Cursor agent activity, potentially indicating post-exploitation data exfiltration or C2 communication (GitHub Advisory, Cato Networks).

The primary remediation is to update Cursor to version 3.0 or later, which fixes the vulnerability by treating canonicalization failures as untrusted: when a target path cannot be resolved (including when read permissions are removed to defeat resolution), the write is blocked rather than falling back to the original path (GitHub Advisory). Until patched, users should exercise caution when using Cursor with untrusted agent prompts, third-party AI models, or when opening repositories from unknown sources. As an additional precaution, users can monitor workspace directories for unexpected symlinks and restrict the Cursor process's filesystem access using OS-level controls where possible (Feedly).

The vulnerability received significant media coverage under the "DuneSlide" campaign name, with major outlets including The Hacker News, SecurityWeek, CSO Online, and GBHackers reporting on the critical sandbox escape flaws (The Hacker News, SecurityWeek, CSO Online). Cato Networks published a detailed technical blog post disclosing the DuneSlide vulnerabilities and credited their AI Labs team with the discovery (Cato Networks). Community discussion was active on Reddit's r/netsec and r/pwnhub, with developers expressing concern about the broader implications of prompt injection as an RCE vector in AI-powered IDEs. The Risky Biz newsletter and TLDR InfoSec also highlighted the vulnerability, underscoring its relevance to the developer security community (Risky Biz).