Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands

What it is

Two critical vulnerabilities in Cursor, the AI code editor, collectively named DuneSlide by Cato AI Labs, tracked as CVE-2026-50548 and CVE-2026-50549. Both are rated 9.8 under CVSS 3.x (9.3 under CVSS 4.0). Both are zero-click: a single ordinary prompt breaks out of Cursor's terminal sandbox and runs arbitrary commands on the developer's machine — no click, no approval box. Every version before Cursor 3.0 (released April 2) is affected; both are patched in 3.0.

How it works

The entry point is prompt injection: the attacker never types into your Cursor. Hidden instructions are planted in something the agent reads on your behalf — a connected service via MCP (even a standard one like the official Linear workspace) or a page returned by web search. You ask a normal question; the injected instructions ride along.

Both flaws share the same goal: get the agent to write one file it should not be allowed to write, then use that write to disable the sandbox.

• CVE-2026-50548 (setting abuse): The sandbox permits writes into a command's working folder. That folder is the optional working_directory parameter on Cursor's run_terminal_cmd tool. When the agent sets it to a non-default path, Cursor adds that path to the allowed-write list without question. Injection points it at a system file — overwrite the sandbox helper itself (on macOS, /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox) and later commands run with no sandbox. Startup files like ~/.zshrc also work.
• CVE-2026-50549 (symlink check fallback): Before writing, Cursor resolves symlinks to confirm the real destination is inside your project. The bug is the fallback: when that check fails — because the target doesn't exist, or the attacker removes read access from a folder in the path — Cursor trusts the shortcut's in-project path instead. The attacker creates a symlink pointing outside the project, forces the check to fail, and Cursor writes through it to the same sandbox helper.

Once the sandbox is neutralized, the next command runs as you — control of the machine plus any cloud/SaaS workspaces the editor is signed into.

What to do

Update to Cursor 3.0 or later. Cursor says more than half the Fortune 500 use the tool; anything on the 2.x line or earlier is vulnerable.

Caveats

No known exploitation in the wild as of publication — Cato presents this as research, not an active campaign. Note the disclosure friction: Cato reported both on February 19; Cursor initially rejected them four days later, saying its threat model didn't cover MCP misuse, then reopened and fixed after escalation on February 26 (CVE IDs assigned June 5). The sandbox itself was Cursor's answer to an earlier wave of prompt-to-execution bugs (CurXecute/CVE-2025-54135, MCPoison/CVE-2025-54136, CVE-2026-26268); DuneSlide is about escaping that answer. Cato argues the problem is structural across coding agents, not Cursor-specific.