Cursor IDE sandbox bypass flaws enable remote code execution through prompt injection

CSO Online and Wired report researchers disclosed two sandbox bypass vulnerabilities in the Cursor AI IDE (CVE-2026-50548 and CVE-2026-50549) that allow remote code execution through prompt injection attacks without requiring jailbreaks. The flaws in the widely-used development tool highlight prompt injection as a viable remote code execution vector in AI-integrated environments.