Critical DuneSlide Flaws in Cursor IDE Let Prompt Injection Escape the Sandbox

Security researchers at Cato Networks disclosed two critical remote code execution vulnerabilities in Cursor, the AI-powered code editor used by more than half of Fortune 500 companies, that could be triggered without any user interaction. Dubbed "DuneSlide" and tracked as CVE-2026-50548 and CVE-2026-50549, both flaws carry the maximum-severity 9.8 CVSS score and were patched in Cursor 3.0, released April 2, 2026.

What makes DuneSlide unusual is the attack vector: neither vulnerability requires a developer to click a malicious link, open a suspicious file, or grant elevated permissions. Both are triggered through zero-click prompt injection — a developer simply asks Cursor's AI agent an ordinary coding question, and the agent, while researching the answer, ingests attacker-controlled content from an untrusted source such as an MCP server response or a poisoned web search result. That content contains hidden instructions the AI agent follows without the developer ever seeing them.

The first flaw, CVE-2026-50548, exploits how Cursor's sandbox constructs its write permissions. The working_directory parameter passed to Cursor's run_terminal_cmd tool is controlled by the LLM itself rather than being fixed by the application, and Cursor's sandbox blindly adds whatever path the LLM specifies to its allowed write list. A prompt injection can steer the agent into setting that parameter to a path outside the project root, granting write access to sensitive system locations — including the cursorsandbox helper binary that enforces the sandbox in the first place.

The second flaw, CVE-2026-50549, is an independent bug in Cursor's path resolution logic. When Cursor attempts to canonicalize a file path and that canonicalization fails — for example, because the target doesn't exist yet or lacks read permissions — the editor falls back to trusting the original, unvalidated path. A prompt injection can direct the agent to create a symlink inside the project directory that points to a protected file outside it, and Cursor's fallback behavior lets the write proceed through the symlink.

Chained together, either vulnerability allows an attacker to overwrite the cursorsandbox binary itself, converting what should be a sandboxed command execution into full, unsandboxed remote code execution on the developer's machine — and, by extension, on any connected SaaS workspace or CI system the developer's credentials can reach.

Cato AI Labs, led by researcher Itay Ravia, reported the vulnerabilities to Cursor's developer, Anysphere, on February 19, 2026. According to Cato's disclosure timeline, the initial report was rejected on February 23 before being escalated to Cursor's security team on February 26. The working directory fix was confirmed for the Cursor 3.0 release on April 1, the symlink fix shipped on June 1, and CVE identifiers were formally assigned on June 5 — nearly four months after the initial report.

DuneSlide is the latest in a growing category of vulnerabilities specific to AI coding agents, where the attack surface extends beyond traditional software flaws into the reasoning process of the AI itself. Because agentic coding tools are designed to autonomously read web content, query external servers via MCP, and execute commands on a developer's behalf, any content the agent ingests during normal operation becomes a potential injection vector — a fundamentally different threat model than the credential theft or software supply chain attacks that have dominated developer tooling security to date.

Every version of Cursor prior to 3.0 is affected. Developers and organizations still running an older release should update immediately; Cato Networks found no evidence of active exploitation in the wild prior to disclosure, but the technical writeup makes both vulnerabilities straightforward to weaponize now that the details are public.

As first reported by Cato Networks and The Hacker News, the disclosure underscores a broader industry challenge: as AI coding assistants gain more autonomy to browse, fetch, and execute on a developer's behalf, security teams need threat models that account for the AI agent itself as an attack surface, not just the code it produces.