ACVE-2026-0005
Cursor prompt injection can reach tools outside the intended sandbox
The configuration
- Configuration label
- cursor <999.0.0
- Affected entries
AgentHarness: cursor — SEMVER (introduced 0)
- Matcher
- all
harness.ideq"cursor"harness.versionsemverRange"<999.0.0"sandboxexists
- all
Why it is exploitable
What the vulnerability is
Cursor prompt injection can reach tools outside the intended sandbox boundary. The advisory summary identifies the security concern, but the current reference set does not establish a complete affected-version range or reproduce the prompt-delivery path. The lockfile record should therefore be used as a possible exposure signal.
Which configuration is exposed
The matcher requires harness.id cursor, a version below <999.0.0>, and the presence of a sandbox field. It does not encode a particular sandbox policy, project, prompt, tool, repository, or model. A configured sandbox is the harness condition that makes this rule relevant; the matcher intentionally does not claim that every sandbox configuration is escapable.
How ACVE detects it
ACVE reads harness.id, harness.version, and the existence of sandbox. It cannot reproduce prompt delivery, inspect the sandbox's allowed paths or capabilities, or show that a tool actually crossed the boundary. The finding is deliberately broad until the affected release and exploit preconditions are grounded.
Fix
- Keep Cursor's sandbox configuration restrictive and review its allowed paths and capabilities.
- Treat repository instructions and other untrusted content as untrusted input; review tool requests before allowing them to act outside the project.
- Run grounding before selecting an upgrade target, then install the confirmed fixed release.
Grounding needed
acve advisory ground must confirm the affected Cursor range, fixed release, and the prompt-injection-to-sandbox behavior represented by CVE-2026-50548 and CVE-2026-50549.
The sandbox action is a precaution while the release boundary and prompt-delivery conditions remain unresolved.
References
See references for primary sources.
Underlying CVEs / aliases
Detect
npx @pickbitsai/acve audit
For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.
Fix
Keep Cursor sandboxed and upgrade after the affected range is confirmed.
| Action | Target | To | Why |
|---|---|---|---|
| reconfigure | settings:cursor:sandbox | restrictive | Limit tool execution while the prompt-injection exposure is being grounded. |
Validation
No validation entries recorded.
Grounding
- OSV: not found; checked-at 2026-09-20T02:43:28Z
- NVD: not found; checked-at 2026-09-20T02:43:28Z
- KEV: not listed in KEV; checked-at 2026-09-20T02:43:28Z