CVE-2026-50549 is a sandbox escape (CWE-59) in the Cursor code editor before version 3.0, scored 9.8 critical. When path resolution fails, the agent writes without approval, so a symlink can send a write outside the workspace. Update Cursor to 3.0 or later.
What's affected
Cursor versions before 3.0. The vendor advisory lists affected versions below 3.0 and the patched version as 3.0.
The problem sits in how the agent checks a write target before it saves a file. It affects the desktop editor when the agent runs terminal commands and writes files in a workspace.
How to check if you're exposed
Open the Cursor menu, choose About Cursor, and read the version. From a terminal you can also run:
cursor --version
Anything below 3.0 is affected. Machines you do not manage, such as developer laptops, are the usual gap, so ask for the version from each team.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Update Cursor to version 3.0 or later on every machine that has it.
- Be careful with agent runs in repositories or prompts you do not trust until you have updated.
- Check whether any workspace contains symlinks that point outside the project directory.
- Review the home directory and tool locations for files you did not expect, if an untrusted agent session ran on an older version.
- Keep approval prompts for file writes switched on.
Why it matters
The agent normally canonicalizes a target path, which resolves symlinks and checks the real location is inside the workspace. The advisory says that when canonicalization failed, the code fell back to the original path and wrote without asking. A link inside the workspace that points elsewhere, together with a failure to resolve it, defeats the check.
This is link following, CWE-59. The advisory explains the impact: files could be written outside the workspace under the user's privileges, which can lead to code execution outside the sandbox. The fix treats a failed resolution as untrusted and blocks the write. The record does not flag the CVE as exploited in the wild and it is not in the CISA KEV catalog.
Quick check
Does this need a malicious repository?
The advisory describes a malicious agent. Treat untrusted prompts and projects with care until you update.
Is version 3.0 the only fix?
It is the patched version named by the vendor advisory.
Sources
Last reviewed: 19 October 2026.
