Cursor runs agent terminal commands in a sandbox that grants write access to the command's working directory. A flaw in handling the working_directory parameter allows an agent to set it to any writable location, thereby extending the sandbox beyond the intended workspace. This permits a malicious agent to write files outside the workspace, including overwriting the cursorsandbox helper, which results in subsequent commands running unsandboxed under the user’s privileges. The result is the ability to execute arbitrary code without further user interaction beyond a normal prompt.

Cursor versions earlier than 3. The problem is present in all builds of Cursor prior to the release that fixed the issue in version 3.0.

With a CVSS score of 9.3, this vulnerability is considered critical. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector involves a compromised or malicious Agent that sets a harmful working_directory; no user authentication or interaction is required beyond the initial benign prompt. Once exploited, the attacker gains remote execution rights with the user’s privileges.