STUPID-2026-0096

Cursor's terminal sandbox trusted an agent-set working directory, letting zero-click prompt injection escape it and gain code execution (CVE-2026-50548)

9.8critical
June 5, 2026VerifiedReproducible

  1. Instruction given

    N/A — this is a flaw in Cursor's own terminal-sandbox design, triggerable by content the agent merely reads (e.g. an MCP tool response or a web page), not a task a user knowingly asked the agent to perform.

  2. Expected behavior

    Cursor's agent terminal sandbox should confine command execution and file writes to the project workspace regardless of what parameters the agent itself sets, so that content the agent reads cannot expand its own write access.

  3. Actual behavior

    Before version 3.0, Cursor's sandbox granted write access to the working directory of an agent-run terminal command, and the agent could set that working_directory parameter itself. A prompt injected into content the agent merely read (an MCP connector response, a web search result) could instruct it to point working_directory at a sensitive path outside the workspace and overwrite the cursorsandbox helper binary that enforces the sandbox, disabling sandboxing for every command that followed — remote code execution with no click or approval from the user.

  4. Damage

    Rated CVSS 9.8 (3.1) / 9.3 (4.0), critical. Any content an agent read — not just code it was told to run — could achieve unsandboxed code execution on the developer's machine under the developer's own privileges, exposing local secrets, source, and credentials. Disclosed by Cato AI Labs as one of two paired flaws named DuneSlide (with CVE-2026-50549); fixed in Cursor 3.0.

Cato AI Labs disclosed that Cursor's default sandbox for agent-run terminal commands — meant to confine writes to the project workspace — could be escaped without any user interaction. The sandbox allowed writes to a command's working directory, and `working_directory` was a parameter the agent itself controlled. Because Cursor's agent can act on instructions hidden in content it merely reads (an MCP tool's response, a web page fetched during a task), an attacker who could get such content in front of the agent could direct it to set `working_directory` to a sensitive location and overwrite `cursorsandbox`, the helper binary that enforces sandboxing. Once that binary was overwritten, every subsequent command ran unsandboxed. No malicious code needed to be run by the user, and no approval prompt intervened — reading poisoned content was enough. Assigned CVE-2026-50548 and rated critical (CVSS 9.8 under 3.1), it was one of two vulnerabilities in the disclosure Cato named DuneSlide; the other, CVE-2026-50549, separately exploited a symlink-resolution fallback for the same effect. Both were fixed in Cursor 3.0.

Classification

Agent
Cursor
Failure mode
Security Vulnerability
Root cause
Other
Domain
Security
Source
Security Research

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.