CVE-2026-50549: Cursor Desktop sandbox escape via symlink and failed path canonicalization

Synopsis

A sandbox-escape vulnerability exists in Cursor Desktop, the AI-assisted code editor, affecting all versions before 3.0. The flaw stems from a failed path canonicalization fallback: when the agent cannot resolve a symlink target, it writes to the original path without approval, allowing an attacker-controlled agent to write files outside the workspace entirely. Successful exploitation enables unsandboxed remote code execution under the user's privileges, with no interaction required beyond a normal prompt. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is reachable over the network, meaning an attacker can interact with the Cursor agent endpoint without requiring physical or local access to the host.

• AuthenticationNot required

  No credentials or prior account access are needed to trigger the vulnerable code path; the exploit requires only the ability to supply a malicious prompt to the agent.

• Victim interactionNot required

  No user action beyond submitting a benign-looking prompt is involved; the sandbox escape and subsequent file write happen automatically within the agent's execution flow.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or environmental prerequisites: creating an in-workspace symlink with a removed or missing target is a deterministic operation under normal filesystem permissions.

Blast Radius

• The attacker writes arbitrary files on the host filesystem under the user's privileges, including outside the workspace directory.
• By overwriting the cursorsandbox helper binary, subsequent agent terminal commands execute without any sandbox restrictions.
• With unsandboxed execution established, the attacker runs arbitrary code as the logged-in user, gaining full access to secrets, credentials, and source code present on the machine.
• All three impact dimensions (confidentiality, integrity, availability) of the vulnerable component are fully compromised: stored files and tokens are readable, persistent data is modifiable, and processes or files can be corrupted or deleted.