Cursor DuneSlide CVEs Enable Zero-Click Prompt Injection RCE on Developer Machines

Two critical vulnerabilities in the Cursor AI code editor enable zero-click prompt injection attacks that break out of the IDE’s security sandbox and run arbitrary commands on a developer’s machine. Discovered by Cato AI Labs and named DuneSlide, the flaws are tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 CVSS.

What Happened: DuneSlide Critical Cursor Sandbox Escape Vulnerabilities

Cursor is a widely adopted AI-powered code editor used by more than half of Fortune 500 companies. Furthermore, its AI agent can execute terminal commands inside a sandbox to limit damage from rogue instructions. However, Cato AI Labs found two flaws that let an attacker escape that sandbox entirely.

The attack starts with prompt injection. Consequently, the developer never clicks a malicious link or approves a suspicious action. Instead, the attacker hides instructions inside content the AI agent reads automatically, such as a web search result or an MCP server response. Therefore, a single ordinary-looking prompt can silently disable the sandbox and seize control of the host.

Cato reported both issues on February 19, 2026. Cursor initially rejected them four days later, arguing its threat model did not cover misuse of standard MCP servers. Moreover, Cato escalated on February 26, and Cursor reopened the reports. The vendor patched both flaws in Cursor 3.0, which shipped on April 2. Every version prior to 3.0 remains vulnerable.

Technical Details of the Cursor Sandbox Escape

Both vulnerabilities abuse the same underlying pattern: get the agent to write a file it should not be allowed to write, then use that write to turn off the sandbox. The two flaws take different paths to the same outcome.

• CVE-2026-50548 — Working Directory Abuse: The sandbox permits writes into a command’s working folder, and that folder is an optional parameter on Cursor’s run_terminal_cmd tool. Injected instructions set the working_directory to a system path, which adds that path to the allowed-write list without validation. The attacker overwrites the sandbox helper itself, and later commands run with no sandbox at all.
• CVE-2026-50549 — Symlink Bypass: Before writing, Cursor resolves symlinks to confirm the real destination sits inside the project. When that check fails because the target does not exist or read access is removed from a folder in the path, Cursor falls back to trusting the shortcut’s in-project path. An attacker creates a symlink pointing outside the project, forces the check to fail, and Cursor writes straight through it to the same sandbox helper.

Once the sandbox is neutralized, the next command runs as the developer. In addition, the attacker gains access to any cloud or SaaS workspaces the editor is signed into.

Business and Operational Impact

Cursor’s user base includes developers at major enterprises, financial institutions, and government agencies. Because the attack is zero-click, traditional user-awareness training and email filtering provide little protection.

• Supply-Chain Exposure: Developers with access to production environments, CI/CD pipelines, and source code repositories can be compromised silently.
• Cloud Credential Theft: Cursor sessions often hold tokens for AWS, Azure, GCP, and GitHub. Consequently, a sandbox escape can pivot directly into cloud infrastructure.
• Intellectual Property Risk: Attackers can exfiltrate source code, API keys, and internal documentation from the compromised machine.
• Compliance Implications: Organizations under SOC 2, ISO 27001, or PCI-DSS may face audit findings if vulnerable Cursor versions remain in use.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Update Cursor immediately. Upgrade to version 3.0 or later. Every version before 3.0 is affected.
2. Audit MCP server connections. Review which Model Context Protocol servers are configured and restrict them to trusted sources only.
3. Monitor for sandbox tampering. Watch for unexpected modifications to ~/.cursor, ~/.zshrc, and related startup files on developer machines.
4. Segment developer environments. Run Cursor in isolated VMs or containers with limited access to production credentials.
5. Enable endpoint detection. Ensure EDR agents on developer workstations can detect suspicious child processes spawned by the Cursor application.

Longer-Term Recommendations

Development teams should treat AI code editors as high-risk endpoints. In addition, security teams should inventory all AI-assisted development tools in use and enforce update policies that match or exceed those for browsers and operating systems.

Bottom line: Cursor 3.0 patches both CVEs. Organizations running older versions should upgrade now and review what untrusted data their AI agents may have ingested.

Incident Summary

CVE ID / Incident:	CVE-2026-50548 and CVE-2026-50549 (DuneSlide)
Affected Systems:	Cursor AI code editor versions prior to 3.0 (macOS, Linux, Windows)
Disclosure Date:	July 01, 2026
Patch Status:	Fixed in Cursor 3.0, released April 02, 2026
Severity:	CVSS 9.8 / CVSS 4.0 9.3
Known Exploitation:	No known active exploitation as of publication

References

1. Cato Networks, “DuneSlide: Two Critical RCE Vulnerabilities,” July 2026, https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/, accessed July 01, 2026.
2. The Hacker News, “Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands,” July 01, 2026, https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html, accessed July 01, 2026.
3. Cursor Security Advisory, “GHSA-3v8f-48vw-3mjx,” https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx, accessed July 01, 2026.
4. National Vulnerability Database, “CVE-2026-50549 Detail,” https://nvd.nist.gov/vuln/detail/CVE-2026-50549, accessed July 01, 2026.