# Cursor IDE "DuneSlide" Sandbox Escape RCE via Zero-Click Prompt Injection (CVE-2026-50548, CVE-2026-50549)

> Cato AI Labs disclosed two critical (CVSS 9.8/3.1, 9.3/4.0) vulnerabilities in the Cursor AI code editor, collectively named "DuneSlide," that allow a zero-click indirect prompt injection delivered via a Model Context Protocol (MCP) server response or a poisoned web search result to escape Cursor's command sandbox and achieve unauthenticated remote code execution on the developer's workstation. CVE-2026-50548 abuses the agent-controlled `working_directory` parameter of the `run_terminal_cmd` tool to write outside the workspace; CVE-2026-50549 abuses a fail-open fallback in symlink/path canonicalization. Both are patched in Cursor 3.0 (released April 2, 2026); no active in-the-wild exploitation has been reported as of disclosure.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1047
- **ID:** TL-2026-1047
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50548, CVE-2026-50549

## Description

Cursor is an AI-native fork of VS Code used as an agentic coding assistant; Cursor's own marketing states it is used by more than half of Fortune 500 companies. To limit the blast radius of an LLM agent that can run shell commands on a developer's behalf, Cursor wraps agent-issued terminal commands in a sandbox that restricts filesystem writes to the current project workspace.

Cato AI Labs (the AI-security research arm of Cato Networks, previously operating under the Aim Security brand) found that this sandbox could be escaped entirely through two independent, chainable defects, together branded "DuneSlide":

1. **CVE-2026-50548 — working_directory sandbox bypass (CWE-22, Path Traversal).** Cursor's `run_terminal_cmd` tool exposes an optional `working_directory` parameter that the LLM agent itself controls. The sandbox's write-allow-list is derived from this parameter without validation: if the agent (under attacker influence) sets `working_directory` to a sensitive path such as the directory containing Cursor's own sandbox helper binary, the sandbox grants write access there. An attacker who can influence the agent's next tool call — for example via text embedded in an MCP tool response or a web page returned by a search-augmented prompt — can direct the agent to overwrite the `cursorsandbox` helper itself (macOS path: `/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox`) or a shell startup file such as `~/.zshrc`. Once the sandbox helper or shell profile is overwritten, every subsequent agent-issued command executes completely unsandboxed, and shell-profile persistence means the payload can run again on the victim's next interactive shell session.

2. **CVE-2026-50549 — symlink canonicalization fail-open (CWE-59, Improper Link Resolution / Link Following).** Before permitting a write, Cursor canonicalizes (resolves) the destination path to confirm it truly resolves inside the workspace, defeating naive symlink-based escapes. The flaw is in the failure path: if canonicalization cannot complete — because the target does not yet exist, or because a directory in the path has had read permission stripped — Cursor falls back to trusting the *original*, unresolved path string rather than refusing the write. An attacker-influenced agent can therefore create an in-workspace symlink pointing to a location outside the workspace, deliberately break canonicalization (e.g. by chmod-ing an intermediate directory), and have Cursor write through the symlink to an arbitrary out-of-workspace destination — the same `cursorsandbox`/shell-profile targets as CVE-2026-50548 — again yielding full sandbox escape and RCE.

Both vulnerabilities are triggered without any user click or approval dialog, because they ride on tool calls (`run_terminal_cmd`, file writes) that the agent is already authorized to make; the attacker's leverage is purely over the *arguments* to those calls via indirect prompt injection — hidden instructions embedded in content the agent reads on the user's behalf (an MCP server's JSON response, or the body of a page surfaced by an agent-invoked web search). No memory-corruption, credential theft, or network C2 is required; the entire chain is a logic/trust-boundary flaw in how Cursor scopes filesystem writes for its own AI agent.

Cato AI Labs reported both issues to Cursor on 2026-02-19. Cursor initially closed the reports, stating its threat model did not consider MCP response content untrusted; Cato escalated on 2026-02-26, after which Cursor reopened and triaged both. Fixes shipped in Cursor 3.0 on 2026-04-02, restricting `working_directory` from being used to expand the write-allow-list and making canonicalization failures fail closed (deny the write) instead of falling back to the raw path. CVE identifiers were assigned 2026-06-05 and public reporting followed 2026-07-01. DuneSlide is the latest in a recurring pattern of Cursor security defects that begin with a poisoned prompt and end in code execution — preceded by CurXecute (CVE-2025-54135, MCP config file rewritten via Slack message poisoning), MCPoison (CVE-2025-54136, silent post-approval MCP config tampering), and a Git-hook-based sandbox escape (CVE-2026-26268) — reflecting a systemic gap between Cursor's sandbox threat model and the reality that agent-consumed content (MCP responses, search results, repository contents) is attacker-reachable and must be treated as untrusted input.

## MITRE ATT&CK

- T1593.002 Search Engines
- T1588.006 Vulnerabilities
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1189 Drive-by Compromise
- T1059.004 Unix Shell
- T1546.004 Unix Shell Configuration Modification
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1036.005 Match Legitimate Resource Name or Location
- T1222.002 Linux and Mac Permissions
- T1083 File and Directory Discovery
- T1518.001 Security Software Discovery
- T1565.001 Stored Data Manipulation
- T1199 Trusted Relationship
- T1574 Hijack Execution Flow

## Sources

- [Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands](https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html)
- [Critical Cursor bug could turn routine Git into RCE](https://www.csoonline.com/article/4164250/critical-cursor-bug-could-turn-routine-git-into-rce.html)
- [Cursor IDE RCE Vulnerabilities](https://cybersecuritynews.com/cursor-ide-rce-vulnerabilities/)
- [NVD - CVE-2026-50548](https://nvd.nist.gov/vuln/detail/CVE-2026-50548)
- [NVD - CVE-2026-50549](https://nvd.nist.gov/vuln/detail/CVE-2026-50549)
- [GitHub Security Advisory GHSA-3p48-7v9f-v5cw (CVE-2026-50548)](https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw)
- [GitHub Security Advisory GHSA-3v8f-48vw-3mjx (CVE-2026-50549)](https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx)
- [Cato AI Labs - AI Security Research](https://www.catonetworks.com/cato-ai-labs/)
- [Critical RCE Vulnerability in Cursor IDE Exposed (MCP trust bypass / MCPoison)](https://blog.checkpoint.com/research/cursor-ide-persistent-code-execution-via-mcp-trust-bypass/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1047