News

Researchers at Cato AI Labs uncovered a pair of severe vulnerabilities in Cursor, an AI-driven code editor, that can allow a seemingly innocuous prompt to break out of the editor’s sandbox and execute arbitrary commands on a developer’s machine. Cato labeled the issue set “DuneSlide.” The two bugs are tracked as CVE-2026-50548 and CVE-2026-50549 and carry very high severity ratings (9.8/10 under the older scale, 9.3 under CVSS 4.0). Cursor released patches in version 3.0 on April 2; any release before 3.0 is vulnerable. Cursor says the editor is used by more than half of the Fortune 500, so users should apply the update without delay.

Cursor introduced a sandbox for terminal commands in the 2.x series: the editor runs AI-issued shell commands inside a restricted environment to limit what those commands can modify. DuneSlide is an attack that exits that containment. The exploit vector is prompt injection – the attacker does not directly type into your Cursor session. Instead, malicious instructions are embedded in content the agent fetches for you, such as responses from a connected service over the Model Context Protocol (MCP) or a search-result page. When you submit an ordinary query, the hidden payload rides along and executes without any user click or confirmation, creating a zero-click compromise.

Both vulnerabilities follow the same general playbook: coerce the agent into writing a file it should not be permitted to create, then use that file to disable the sandbox. CVE-2026-50548 abuses an unchecked setting. Cursor’s sandbox allows writes into the working directory of a command, and that directory is controllable via the optional working_directory parameter in the run_terminal_cmd tool. When the agent specifies a non-default working directory, Cursor adds that path to the list of allowed write locations without sufficient validation. An attacker can point this parameter at a system file instead of the project folder and overwrite the sandbox helper binary (on macOS, for example, the helper path is /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox). Overwriting that helper – or even user startup files such as ~/.zshrc – removes the sandbox protections for subsequent commands.

CVE-2026-50549 exploits a different check-failure logic. Before it writes a file, Cursor attempts to resolve symbolic links to ensure the real destination lies inside the project. The bug arises in the fallback behavior: if that resolution fails – because the target doesn’t exist or read permissions have been removed on an intermediate folder – Cursor abandons the thorough check and trusts the shortcut’s in-project path. An attacker can therefore create a symlink that points outside the project, force the resolution to fail, and cause Cursor to write through the link straight to the same sandbox helper file. Different failure mode, same escape.

Once the sandbox helper is altered or replaced, the next terminal command the agent issues runs with the user’s full privileges. That gives an attacker control over the developer’s local machine and any cloud or SaaS environments where the editor is authenticated. All of this can be triggered by a single, benign-looking prompt that the agent processes automatically.

There is currently no public evidence these vulnerabilities were used in the wild. Cato presented the findings as research rather than reporting active exploitation, and public vulnerability records show no confirmed abuse at the time of publication. Cato first disclosed the issues to Cursor on February 19. According to Cato, Cursor initially rejected the report four days later, arguing its threat model did not cover misuse of MCP servers, including routine integrations such as the official Linear workspace. Cato escalated on February 26; Cursor then reopened and triaged the reports and shipped fixes in the 3.0 release. The CVE identifiers were assigned on June 5. Cursor has published an advisory addressing the symlink issue, and the NVD listings for the CVEs are available at the U.S. National Vulnerability Database: CVE-2026-50548 and CVE-2026-50549.

DuneSlide follows a string of earlier Cursor vulnerabilities that chain a poisoned prompt into arbitrary command execution, each defeating a different safeguard. Notable predecessors include CurXecute (CVE-2025-54135, August 2025), reported by the same research team when it operated as Aim Security; that flaw used a crafted Slack message to rewrite Cursor’s ~/.cursor/mcp.json configuration and execute commands even after a user rejected the change (patched in 1.3). Check Point Research disclosed MCPoison (CVE-2025-54136), which allowed an attacker to get an MCP configuration approved once and then swap in malicious commands without a second prompt. In February 2026 a separate issue, CVE-2026-26268, hid a malicious Git hook in a repository that fired when the agent issued Git commands; that bug was fixed in Cursor 2.5.

The sandbox introduced in the 2.x series was intended as a mitigation against that earlier wave of prompt-based abuses. DuneSlide demonstrates how an attacker can still subvert that defense.