Two critical remote code execution flaws in Cursor IDE let attackers exploit prompt injection to escape the editor’s sandbox and take over developer machines.
Cato AI Labs has disclosed these vulnerabilities, collectively named “DuneSlide,” affecting the AI-powered code editor used by more than half of the Fortune 500.
Both flaws, tracked as CVE-2026-50548 and CVE-2026-50549, carry a CVSS 3.1 score of 9.8 and allow zero-click prompt injection that can escalate to full system compromise.
Cursor IDE Critical RCE Flaws
The exploit chain begins when a developer submits an innocuous prompt that inadvertently causes Cursor’s agent to ingest attacker-controlled content from an untrusted source, such as an MCP server response or a poisoned web search result.
No user click or approval is required beyond the original benign prompt, making this a true zero-click attack vector.
Once the payload is processed, the injected instructions manipulate Cursor’s sandbox logic to write to the cursor sandbox helper binary, neutralizing sandbox protections for all subsequent commands in the same session.
Vulnerability #1: Working Directory Abuse
Prior to Cursor 3.0, the run_terminal_cmd tool grants write access to a command’s current working directory when constructing its sandbox policy.
Because working_directory is an optional, LLM-controllable parameter, a prompt injection can steer the agent into setting it to an attacker-chosen path outside the project scope, which Cursor blindly adds to its allowed-write list.
This lets an attacker overwrite the Cursor sandbox executable directly, converting later sandboxed commands into unsandboxed RCE.
Vulnerability #2: Symlink Canonicalization Bypass
The second flaw is architecturally independent and exploits how Cursor validates write targets before honoring a Write tool call.
Cursor attempts to canonicalize symlink paths to confirm they resolve within the project root, but when canonicalization fails because the target doesn’t exist or lacks read permissions, the agent falls back to trusting the symlink’s in-project path instead of blocking the write.
An attacker can plant a write-only symlink pointing at the cursorsandbox binary, tricking Cursor into writing through it and disabling sandbox restrictions for subsequent commands.
Cato AI Labs reported both issues to the Cursor team on February 19, but the vulnerabilities were initially rejected on February 23 on the grounds that Cursor’s threat model didn’t account for MCP server misuse.
After escalation on February 26, the security team reopened and triaged the reports, confirming fixes for the working-directory issue would ship in Cursor 3.0, released April 2, 2026, with the symlink fix following by June 1.
All versions of Cursor prior to 3.0 remain exposed, and organizations running the IDE, including a majority of Fortune 500 companies, should confirm they have upgraded.
Cato Networks indicates it is applying similar responsible-disclosure research to other popular AI coding agents, framing DuneSlide as evidence of a systemic architectural risk rather than an isolated bug pair.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
