CVE-2026-50548/50549: Cursor AI Code Editor — Remote OS Code Execution (April 2026)

CVE-2026-50548/50549 — Cursor AI Code Editor

CVE-2026-50548 and CVE-2026-50549 are critical vulnerabilities in the Cursor AI code editor, allowing attackers to bypass the IDE sandbox and execute arbitrary code on the underlying operating system. Both flaws are rated critical and have been patched as of version 3.0 (April 2, 2026). There is no evidence of active exploitation at this time, but the risk of compromise is severe.

Attack Vector

Attackers leverage prompt injection techniques to manipulate the AI-driven features within the Cursor AI code editor. By crafting malicious prompts or code snippets, adversaries can escape the intended sandbox restrictions, gaining the ability to run OS-level commands without user interaction or approval. No authentication or elevated privileges are required; exploitation can occur via shared projects, malicious code imports, or poisoned AI prompts. Indicators of compromise are not specified, but organizations should monitor for unexpected process launches or anomalous outbound connections originating from the IDE environment.

Who Is at Risk

All organizations and users running Cursor AI code editor versions prior to 3.0 are vulnerable. This includes individual developers, enterprise deployments, and any environment where the code editor is integrated into CI/CD pipelines or developer workstations. Cursor AI is the only confirmed affected vendor at this time.

Patch & Mitigate

• Patch: Upgrade to Cursor AI code editor version 3.0 or later immediately. This release, issued April 2, 2026, addresses both CVEs.
• Workaround: No effective workaround is available. Disabling AI-driven features may reduce risk but does not eliminate the underlying flaw.
• Detect: Review IDE and system logs for unauthorized process execution, unexpected shell invocations, or suspicious network activity originating from the Cursor AI process.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit prompt injection to gain initial execution within the IDE.
• TA0005 — Defense Evasion: Sandbox bypass enables execution of code outside intended boundaries.
• TA0007 — Discovery: Attackers may enumerate system resources or network connections after gaining OS-level access.

Source: https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/