Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
Summary: Cato AI Labs found two flaws in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 and rated 9.8 out of 10, that let a prompt injection planted in an MCP service or a web search result write a file the agent should not write and use that write to disable the sandbox. Both are patched in Cursor 3.0, released April 2, and every earlier version is affected; Cato reported them February 19, Cursor rejected them four days later, and Cato escalated on February 26 before the fixes shipped.
Key Takeaway: Cursor says more than half the Fortune 500 use the tool, and once the sandbox is off the next command runs as the developer, taking any cloud or SaaS workspace the editor is signed into with it - from one prompt that needs no click or approval.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2026-50548CVE-2026-50549
- Related
- ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More Cyber Risks ·SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026