Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click Prompt Injection (CVE-2026-50548, CVE-2026-50549)

Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click (TL-2026-1047), also tracked as DuneSlide, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-01. It has no confirmed attribution, affects Anysphere Cursor (AI code editor), references 2 CVEs (CVE-2026-50548, CVE-2026-50549), maps to 16 MITRE ATT&CK techniques (T1036.005, T1059.004, T1083), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1047

Threat ID
TL-2026-1047
Also known as
DuneSlide
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, software-development, finance, government administration, health, critical-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
20

Malware and tooling in Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

Malware and tooling: Cursor (Cursor Desktop, versions prior to 3.0), Cursor 3.0, Model Context Protocol (MCP)

Cato AI Labs disclosed two critical (CVSS 9.8/3.1, 9.3/4.0) vulnerabilities in the Cursor AI code editor, collectively named "DuneSlide," that allow a zero-click indirect prompt injection delivered via a Model Context Protocol (MCP) server response or a poisoned web search result to escape Cursor's command sandbox and achieve unauthenticated remote code execution on the developer's workstation. CVE-2026-50548 abuses the agent-controlled `working_directory` parameter of the `run_terminal_cmd` tool to write outside the workspace; CVE-2026-50549 abuses a fail-open fallback in symlink/path canonicalization. Both are patched in Cursor 3.0 (released April 2, 2026); no active in-the-wild exploitation has been reported as of disclosure.

How Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click works

Cursor is an AI-native fork of VS Code used as an agentic coding assistant; Cursor's own marketing states it is used by more than half of Fortune 500 companies. To limit the blast radius of an LLM agent that can run shell commands on a developer's behalf, Cursor wraps agent-issued terminal commands in a sandbox that restricts filesystem writes to the current project workspace.

Cato AI Labs (the AI-security research arm of Cato Networks, previously operating under the Aim Security brand) found that this sandbox could be escaped entirely through two independent, chainable defects, together branded "DuneSlide":

1. **CVE-2026-50548 — working_directory sandbox bypass (CWE-22, Path Traversal).** Cursor's `run_terminal_cmd` tool exposes an optional `working_directory` parameter that the LLM agent itself controls. The sandbox's write-allow-list is derived from this parameter without validation: if the agent (under attacker influence) sets `working_directory` to a sensitive path such as the directory containing Cursor's own sandbox helper binary, the sandbox grants write access there. An attacker who can influence the agent's next tool call — for example via text embedded in an MCP tool response or a web page returned by a search-augmented prompt — can direct the agent to overwrite the `cursorsandbox` helper itself (macOS path: `/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox`) or a shell startup file such as `~/.zshrc`. Once the sandbox helper or shell profile is overwritten, every subsequent agent-issued command executes completely unsandboxed, and shell-profile persistence means the payload can run again on the victim's next interactive shell session.

2. **CVE-2026-50549 — symlink canonicalization fail-open (CWE-59, Improper Link Resolution / Link Following).** Before permitting a write, Cursor canonicalizes (resolves) the destination path to confirm it truly resolves inside the workspace, defeating naive symlink-based escapes. The flaw is in the failure path: if canonicalization cannot complete — because the target does not yet exist, or because a directory in the path has had read permission stripped — Cursor falls back to trusting the *original*, unresolved path string rather than refusing the write. An attacker-influenced agent can therefore create an in-workspace symlink pointing to a location outside the workspace, deliberately break canonicalization (e.g. by chmod-ing an intermediate directory), and have Cursor write through the symlink to an arbitrary out-of-workspace destination — the same `cursorsandbox`/shell-profile targets as CVE-2026-50548 — again yielding full sandbox escape and RCE.

Both vulnerabilities are triggered without any user click or approval dialog, because they ride on tool calls (`run_terminal_cmd`, file writes) that the agent is already authorized to make; the attacker's leverage is purely over the *arguments* to those calls via indirect prompt injection — hidden instructions embedded in content the agent reads on the user's behalf (an MCP server's JSON response, or the body of a page surfaced by an agent-invoked web search). No memory-corruption, credential theft, or network C2 is required; the entire chain is a logic/trust-boundary flaw in how Cursor scopes filesystem writes for its own AI agent.

Cato AI Labs reported both issues to Cursor on 2026-02-19. Cursor initially closed the reports, stating its threat model did not consider MCP response content untrusted; Cato escalated on 2026-02-26, after which Cursor reopened and triaged both. Fixes shipped in Cursor 3.0 on 2026-04-02, restricting `working_directory` from being used to expand the write-allow-list and making canonicalization failures fail closed (deny the write) instead of falling back to the raw path. CVE identifiers were assigned 2026-06-05 and public reporting followed 2026-07-01. DuneSlide is the latest in a recurring pattern of Cursor security defects that begin with a poisoned prompt and end in code execution — preceded by CurXecute (CVE-2025-54135, MCP config file rewritten via Slack message poisoning), MCPoison (CVE-2025-54136, silent post-approval MCP config tampering), and a Git-hook-based sandbox escape (CVE-2026-26268) — reflecting a systemic gap between Cursor's sandbox threat model and the reality that agent-consumed content (MCP responses, search results, repository contents) is attacker-reachable and must be treated as untrusted input.

MITRE ATT&CK techniques used in TL-2026-1047

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1211 Exploitation for Stealth

Execution

T1059.004 Unix Shell

Discovery

T1083 File and Directory Discovery; T1518.001 Security Software Discovery

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

defense-impairment

T1222.002 Linux and Mac Permissions

Persistence

T1546.004 Unix Shell Configuration Modification

Impact

T1565.001 Stored Data Manipulation

stealth

T1574 Hijack Execution Flow

Resource Development

T1588.006 Vulnerabilities; T1608.001 Upload Malware

Reconnaissance

T1593.002 Search Engines

Privilege Escalation

T1611 Escape to Host

Affected products and versions in Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

  • Anysphere — Cursor (AI code editor)
    Vulnerable versions: all versions prior to 3.0
    Fixed in: 3.0

Remediation for Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

Patches

  • Cursor 3.0 (released 2026-04-02) patches both CVE-2026-50548 and CVE-2026-50549

Immediate actions

  • Upgrade all Cursor IDE installations to version 3.0 or later, which restricts working_directory from expanding the sandbox write-allow-list and fails closed on canonicalization errors
  • Audit connected MCP servers and remove/disable any that are not fully trusted, since MCP tool responses are the primary indirect-prompt-injection delivery path
  • Disable or tightly scope agent-invoked web search tools until upgraded, since poisoned search results are the second disclosed injection vector
  • Inspect shell startup files (~/.zshrc, ~/.bashrc, ~/.bash_profile) and the cursorsandbox helper binary on developer workstations for unexpected modifications made prior to patching

Workarounds

  • No official interim workaround; disabling agent access to run_terminal_cmd, MCP servers, and web search tools reduces but does not eliminate exposure pre-patch

Longer-term hardening

  • Treat all content read by an AI coding agent (MCP responses, web pages, repository files, issue/PR text) as untrusted, attacker-reachable input and apply content sanitization / provenance tagging before it reaches the agent's context
  • Enforce endpoint detection and response (EDR) coverage on developer workstations to catch unsandboxed process execution originating from IDE helper processes
  • Require code-signing/integrity verification of IDE sandbox helper binaries at each launch
  • Adopt least-privilege MCP server allowlisting and disable auto-approval of previously trusted MCP configurations without re-diffing on every change

CVEs associated with Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

CVE-2026-50548, CVE-2026-50549

Weaknesses (CWE) in Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

CWE-22, CWE-59

Timeline of Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

  • Cursor ships fix for MCPoison (CVE-2025-54136): silent post-approval MCP configuration tampering enabling persistent code execution, a precedent for the DuneSlide trust-boundary gap
  • CurXecute (CVE-2025-54135) disclosed: Slack message poisoning used to rewrite ~/.cursor/mcp.json and hijack MCP configuration
  • Cato AI Labs privately reports both DuneSlide sandbox-escape vulnerabilities (later CVE-2026-50548 and CVE-2026-50549) to Cursor
  • Cursor initially rejects the reports, stating its threat model does not cover misuse of MCP server content
  • Cato AI Labs escalates; Cursor reopens and triages both vulnerability reports
  • CVE-2026-26268, a separate Git-hook-based sandbox escape in Cursor versions prior to 2.5, is disclosed and patched, underscoring the recurring sandbox-escape pattern
  • Cursor 3.0 released, fixing both CVE-2026-50548 (working_directory sandbox bypass) and CVE-2026-50549 (symlink canonicalization fail-open)
  • CVE-2026-50548 and CVE-2026-50549 identifiers formally assigned
  • NVD publishes vulnerability records for CVE-2026-50548 and CVE-2026-50549
  • Public reporting (Cyber Security News, The Hacker News, CSO Online) details the DuneSlide vulnerabilities; no in-the-wild exploitation reported

Sources cited for Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

Threats related to Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click

Detection coverage for TL-2026-1047

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1047 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats