PatchTheCVECVE-2026-50548: Cursor is a code editor built for programming with AI
CVE-2026-50548 is a critical-severity flaw (CVSS 9.8) affecting cursor. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and w
Why this priority
- Critical severity
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 37%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-06-25 |
| Last modified | 2026-06-26 |
Last updated 2026-06-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-50548?
cursor: upgrade to 3.0. Exact commands for each OS are on this page.
Is CVE-2026-50548 being exploited?
CVE-2026-50548 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-50548 affect?
CVE-2026-50548 affects cursor. Severity is critical (CVSS 9.8). Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent
How urgent is CVE-2026-50548?
Priority 58/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-63093 HIGH 8.8 UPGRADE Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to ach
- CVE-2026-50549 CRITICAL 9.8 UPGRADE Cursor is a code editor built for programming with AI