Cursor, a code editor that runs agent terminal commands in a default sandbox, fails to properly handle symbolic links when path canonicalization fails. When the agent attempts to write to a target path, it expects the path to resolve inside the user's workspace; if resolution fails, it falls back to the original, unvalidated path and proceeds with the write. A malicious agent can create a symlink within the workspace that points to an external location, trigger a canonicalization failure, and cause the agent to write through the link, creating or overwriting files anywhere the user has write access. This flaw allows an attacker to place arbitrary files under the user's privileges, including overwriting protected helpers, thereby enabling privileged Remote Code Execution without user interaction.

Cursor:Cursor, any installation of Cursor prior to version 3.0 is affected. Versions 3.0 and later contain the fix.

The flaw carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not available but the vulnerability is not yet catalogued in the CISA KEV list. Attackers can exploit the flaw from within the local environment or via a malicious agent plugin; no network-facing vector is required. Successful exploitation results in full code execution with user-level privileges, sufficient to compromise system integrity and confidentiality.