CVE-2026-50548: Cursor Desktop sandbox escape via agent-controlled working directory

Synopsis

This is a sandbox-escape vulnerability in Cursor Desktop, the AI-assisted code editor. The flaw allows a malicious AI agent to manipulate the working_directory parameter passed to the sandbox, tricking it into granting write access to paths outside the intended workspace. An attacker who can influence agent behavior can overwrite critical host binaries such as the cursorsandbox helper, achieving full unsandboxed remote code execution under the user's privileges with no interaction required beyond a normal-looking prompt. No fix version has been published yet; HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is reachable over the network; an attacker must be able to deliver a crafted prompt or agent instruction to a running Cursor instance exposed to network-accessible input.

• AuthenticationNot required

  No authentication is required; the attacker needs only to influence the content of an agent prompt, which requires no account or credential on the target system.

• Victim interactionNot required

  No victim interaction beyond submitting a normal-looking prompt is needed; the entire exploit chain executes autonomously once the agent processes the malicious working_directory value.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free, requiring no race conditions, memory-layout knowledge, or other environmental factors.

Blast Radius

• Attacker writes arbitrary files to any path the user has write access to on the host filesystem, including system-level directories.
• Attacker overwrites the cursorsandbox helper binary, causing all subsequent agent terminal commands to run without sandbox restrictions.
• With unsandboxed execution achieved, the attacker runs arbitrary code under the logged-in user's full privileges, including reading source code, credentials, SSH keys, and secrets stored on disk.
• The attacker can establish persistence by modifying shell profiles, cron jobs, or other startup mechanisms accessible to the user.