Vendor
cursor
28 known vulnerabilities.
Products
3 results · Clear filters · Feed
-
Critical 9.3
Cursor Desktop sandbox escape via agent-controlled working directory
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the w…
-
Critical 9.3
Cursor Desktop sandbox escape via symlink and failed path canonicalization
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails…
-
Critical 9.8
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorize…