DuneSlide: two Cursor IDE flaws turn a hidden prompt into code execution on the developer's machine

Two vulnerabilities in the Cursor AI code editor, disclosed by Cato AI Labs on July 1, 2026 and collectively named DuneSlide, let a prompt injection break out of the editor's terminal sandbox and run arbitrary commands on the developer's machine — with no extra click. Tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 on CVSS 3.1, they affect every version of Cursor before 3.0. The entry point is not a malicious binary the developer downloads; it is text the AI agent reads on the developer's behalf — a response from a connected MCP service, or a page returned by a web search.

What we know

• 2026-04-02 — Cursor 3.0 is released, which (per the disclosure) contains the fixes for both flaws.
• 2026-07-01 — Cato AI Labs publicly discloses DuneSlide (CVE-2026-50548, CVE-2026-50549). Reporting notes no evidence of active exploitation at disclosure.
• 2026-07-02/03 — Tier-1 coverage (The Hacker News, SecurityWeek, CSO Online) frames the pair as a demonstration that indirect prompt injection is a genuine RCE vector for agentic AI editors, not a theoretical risk.

Source-layer flag: the vulnerability mechanics, CVE identifiers, CVSS scores, and patch version below are reported from Cato AI Labs' disclosure and tier-1 coverage; they have not been independently reproduced against a Cursor build in our environment.

Technical analysis

Both bugs abuse Cursor's write-sandbox — the boundary that is supposed to keep agent-run terminal commands from touching anything outside the current project.

• CVE-2026-50548 — working-directory allowlist abuse. The sandbox permits writes into a command's working folder. That folder is an optional parameter — working_directory — on Cursor's run_terminal_cmd tool. When the agent sets it to a non-default path, Cursor adds that path to the allowed-write list without challenge. Injected instructions point it at a system location instead of the project. Overwriting the sandbox helper itself — on macOS, /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox — means later commands run with no sandbox at all.
• CVE-2026-50549 — symlink-resolution fallback. Before writing, Cursor resolves symlinks to confirm the real destination sits inside the project. The flaw is the failure mode: when the check cannot complete — because the target does not exist, or the attacker strips read access from a folder in the path — Cursor falls back to trusting the shortcut's in-project path, and writes anyway.

Source-layer flag: the working_directory/run_terminal_cmd and symlink-fallback details above are reported from the Cato AI Labs disclosure, not independently verified.

The important pattern here is that the AI agent is the delivery mechanism. Your developer never runs anything malicious knowingly — the agent, acting on instructions hidden in content it was told to read, spends its own trusted write-access to disable its own sandbox.

Indicators of compromise

Affected software: Cursor IDE, all versions before 3.0.

Fixed version: Cursor 3.0 (released 2026-04-02).

Sandbox-helper overwrite target (macOS): /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox — unexpected modification of this file is a high-fidelity signal.

Behavioral signal: agent-initiated run_terminal_cmd invocations with a working_directory pointing outside the project tree, or writes to paths outside the project immediately after the agent processed external content (MCP response, fetched web page).

No network C2 or file hashes apply — the injection payload is text, and post-escape actions are actor-defined.

Detection and mitigation

• Upgrade Cursor to 3.0 or later now. This is the fix; version pinning below 3.0 is the exposure.
• Inventory AI coding tools across engineering — Cursor and peers — and confirm auto-update is on or push the upgrade through MDM.
• Treat connected MCP servers as attack surface. A poisoned or compromised MCP tool response is a viable injection channel; review which MCP servers your agents connect to and whether they are trusted and authenticated.
• Monitor developer endpoints for modification of the cursorsandbox helper and for terminal writes outside project directories originating from the editor.
• Policy: constrain agent web-search and untrusted-content ingestion where feasible; the injection needs a content channel the agent reads automatically.

Attribution

DuneSlide is vulnerability research disclosed by Cato AI Labs; there is no threat actor to attribute, and reporting states no in-the-wild exploitation was observed at disclosure. What is claimed: two working sandbox-escape primitives exist and are demonstrated by the researchers. What is not claimed: that any criminal or state actor has weaponized them. Confidence that these are exploitable is high (researcher PoC); confidence in any active-exploitation claim is none, because none is asserted. This changes the moment a vendor or IR firm reports the technique used against a real developer host.

Criminal-market signal

Bounded negative (evidenced): on 2026-07-03 we swept ~25 dark-web search engines over Tor for DuneSlide and CVE-2026-50548. Of ~190 pages crawled, the L3 filter flagged 5 as candidate-relevant; manual review classified all 5 as noise — a Monero-wallet page and Debian package-index listings — with no DuneSlide/Cursor exploit offered for sale. No criminal-market listing was found on the venues our pipeline can see (closed forums and Telegram are out of scope). The realistic near-term risk is not a for-sale exploit kit but opportunistic reuse of the public technique: prompt-injection-to-RCE against AI editors is now a documented, named pattern with enough detail for capable actors to reproduce. Because the vector rides ordinary content channels (web pages, MCP responses), it favors broad, low-cost delivery over bespoke tooling — a commodity trajectory rather than an operator-run one, pending any observed listing.

CISO translation

A flaw in the Cursor AI code editor lets a booby-trapped web page or connected service quietly take over a developer's laptop through the AI assistant, without the developer doing anything wrong. This matters because our engineers' machines hold source code, cloud credentials, and internal access — a compromised developer host is one of the fastest routes to a broader breach. Update every Cursor install to version 3.0 or later this week and confirm no one is pinned to an older build. Confidence is high that the flaw is real and exploitable (named research with proof of concept) but there is no sign of active attacks yet, so this is "patch before it's weaponized," not "we are under attack." The cost of inaction is a developer-machine compromise that bypasses most of our perimeter controls, because the attack comes in through a tool we deliberately gave broad access to our codebase.