Critical Cursor AI Code Editor Flaws (CVE-2026-50548, CVE-2026-50549) — "DuneSlide" Zero-Click Prompt Injection to Sandbox Escape and RCE

Critical Cursor AI Code Editor Flaws (CVE-2026-50548 (TL-2026-1049), also tracked as DuneSlide, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-01. It has no confirmed attribution, affects Anysphere Cursor AI Code Editor, references 2 CVEs (CVE-2026-50548, CVE-2026-50549), maps to 18 MITRE ATT&CK techniques (T1036, T1059.004, T1083), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1049

Threat ID
TL-2026-1049
Also known as
DuneSlide
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, software-development, finance, government administration, health, any-sector-using-cursor
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in Critical Cursor AI Code Editor Flaws (CVE-2026-50548

Malware and tooling: Cursor AI Code Editor, Model Context Protocol (MCP)

Two CVSS 9.8 vulnerabilities dubbed "DuneSlide" in the Cursor AI code editor (all versions before 3.0) let a zero-click, indirect prompt injection delivered via an MCP-connected service or a poisoned web search result escape the agent's terminal sandbox and achieve remote code execution on the developer's machine. CVE-2026-50548 abuses the LLM-controlled `working_directory` parameter of the `run_terminal_cmd` tool; CVE-2026-50549 abuses a fail-open symlink-canonicalization fallback. Both were discovered by Cato AI Labs, disclosed to Anysphere on 2026-02-19, fixed in Cursor 3.0 (2026-04-02), and assigned CVEs on 2026-06-05; no in-the-wild exploitation has been confirmed.

How Critical Cursor AI Code Editor Flaws (CVE-2026-50548 works

Cato AI Labs (Cato Networks) identified two critical, chainable design flaws in the sandboxing model of the Cursor AI code editor, collectively branded "DuneSlide." Both allow an attacker who never directly interacts with the victim's Cursor session — but who can plant instructions in content the agent reads on the user's behalf (an MCP tool response, a web page returned by an agent-initiated search, a README, an issue, etc.) — to escape Cursor's terminal-command sandbox entirely and achieve unsandboxed code execution.

CVE-2026-50548 (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) exploits the `working_directory` parameter of Cursor's `run_terminal_cmd` agent tool. This parameter is optional and fully LLM-controlled: when the agent sets it to a non-default path, Cursor's sandbox silently adds that path to its allowed-write list without validating that it stays inside the project root. A prompt-injected instruction can steer the agent to set `working_directory` to a sensitive system location — most critically the sandbox enforcement helper itself, `/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox` on macOS — or to shell startup/autorun locations such as `~/.zshrc` or `~/Library/LaunchAgents`. Overwriting `cursorsandbox` converts every subsequent "sandboxed" terminal command the agent runs into fully unsandboxed execution; overwriting a shell rc file or LaunchAgent grants durable local persistence and execution on next shell/session start.

CVE-2026-50549 (CWE-59, Improper Link Resolution Before File Access) exploits a fail-open fallback in Cursor's pre-write safety check. Before permitting a file write, Cursor resolves symlinks to confirm the real target resides inside the project directory. When that resolution fails — because the symlink target does not exist, or because the attacker has stripped read permission from a directory in the path — Cursor does not deny the write; instead it falls back to trusting the symlink's apparent in-project path and writes through it. An attacker who plants a broken/permission-stripped symlink pointing at the same `cursorsandbox` helper (or other out-of-project targets) can force this fallback and achieve the identical sandbox-helper overwrite as CVE-2026-50548, via a completely independent code path.

Both bugs share the same attacker-controlled entry point: indirect prompt injection. "The attacker never types into your Cursor. They plant instructions inside something your agent reads on your behalf," per the disclosure. Because Cursor's agent autonomously invokes MCP tools and web search and consumes their output as trusted context, any MCP server response or search-indexed web page an attacker can influence becomes a delivery vector — with zero clicks and zero explicit user approval required for the sandbox-escaping write itself.

Impact: successful exploitation grants the attacker control of the developer's local machine plus any cloud or SaaS workspaces the editor session is authenticated into (e.g., Git hosting, cloud IDEs, CI/CD, ticketing integrations reachable via the compromised developer identity) — a significant amplification given Cursor's stated adoption across more than half of the Fortune 500.

Cato reported both issues to Anysphere (Cursor's developer) on 2026-02-19. Anysphere initially rejected the reports on 2026-02-23, asserting MCP misuse fell outside Cursor's threat model; Cato escalated and Anysphere reopened and triaged the reports on 2026-02-26. Both flaws were fixed together in Cursor 3.0, released 2026-04-02. CVE identifiers were assigned on 2026-06-05, with public technical disclosure on 2026-07-01. No confirmed in-the-wild exploitation has been reported by any source as of publication.

This is the third documented category of Cursor prompt-injection-to-RCE vulnerability disclosed within roughly a year: CurXecute (CVE-2025-54135, disclosed by Aim Labs/Cato, fixed in 1.3) abused unapproved `mcp.json` writes to auto-start a malicious MCP server; MCPoison (CVE-2025-54136) silently swapped an approved MCP command for a malicious one post-approval; CVE-2026-26268 abused a Git hook execution path (fixed in 2.5). DuneSlide is architecturally distinct in that it defeats the sandbox's own write-scoping logic directly rather than the MCP-approval workflow, and researchers argue it demonstrates that sandboxing alone — without deeper, architecture-level trust boundaries around agent tool parameters and filesystem path resolution — cannot contain autonomous coding-agent risk.

MITRE ATT&CK techniques used in TL-2026-1049

Defense Evasion

T1036 Masquerading; T1574 Hijack Execution Flow

Execution

T1059.004 Unix Shell; T1204 User Execution

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Collection

T1119 Automated Collection

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

defense-impairment

T1222 File and Directory Permissions Modification; T1553 Subvert Trust Controls

Impact

T1531 Account Access Removal

Persistence

T1543.001 Launch Agent; T1546.004 Unix Shell Configuration Modification

Privilege Escalation

T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Exfiltration

T1567 Exfiltration Over Web Service

Affected products and versions in Critical Cursor AI Code Editor Flaws (CVE-2026-50548

  • Anysphere — Cursor AI Code Editor
    Vulnerable versions: all versions before 3.0
    Fixed in: 3.0; 3.0+

Remediation for Critical Cursor AI Code Editor Flaws (CVE-2026-50548

Patches

  • Cursor 3.0 (released 2026-04-02) fixes both CVE-2026-50548 and CVE-2026-50549.

Immediate actions

  • Upgrade Cursor to version 3.0 or later on all developer workstations immediately.
  • Audit and restrict which MCP servers are configured/auto-approved in `.cursor/mcp.json` across the fleet; remove unused or unvetted MCP integrations.
  • Disable or tightly scope agent web-search tool usage until upgraded, since poisoned search results are a documented delivery vector.
  • Review `~/.zshrc`, shell rc files, and `~/Library/LaunchAgents` (macOS) on developer machines that ran pre-3.0 Cursor for unauthorized modifications.
  • Rotate credentials/tokens for any cloud or SaaS workspace (git hosting, CI/CD, ticketing) that a potentially compromised developer session was authenticated into.

Workarounds

  • Pin `working_directory` usage or disable agent-initiated terminal commands with non-default working directories where feasible in pre-3.0 deployments.
  • Restrict filesystem permissions so the Cursor sandbox helper binary is not writable by the user's own account where the OS/security model allows it.

Longer-term hardening

  • Treat AI coding-agent tool parameters (e.g., working directories, file paths) as untrusted input requiring server-side validation, not solely LLM-side judgment.
  • Adopt architecture-level sandboxing that validates final resolved paths (post symlink-resolution) rather than failing open when resolution errors occur.
  • Apply least-privilege scoping to MCP server capabilities and require explicit human approval for any write outside an agent's declared project root.
  • Monitor EDR/telemetry for unexpected modifications to IDE sandbox helper binaries and shell startup files.

CVEs associated with Critical Cursor AI Code Editor Flaws (CVE-2026-50548

CVE-2026-50548, CVE-2026-50549

Weaknesses (CWE) in Critical Cursor AI Code Editor Flaws (CVE-2026-50548

CWE-22, CWE-59

Timeline of Critical Cursor AI Code Editor Flaws (CVE-2026-50548

  • Check Point Research separately discloses MCPoison (CVE-2025-54136), in which an approved MCP server command is silently swapped for a malicious one post-approval, achieving persistent RCE without re-prompting the user.
  • Aim Labs/Cato Networks disclose CurXecute (CVE-2025-54135), an earlier Cursor prompt-injection-to-RCE chain via unapproved `.cursor/mcp.json` writes that auto-start a malicious MCP server; fixed in Cursor 1.3.
  • CVE-2026-26268 is documented: an AI coding agent in Cursor IDE can be steered to execute arbitrary code via a Git hook execution path, fixed in Cursor 2.5 — the third distinct Cursor prompt-injection-to-RCE category disclosed within roughly a year.
  • Cato AI Labs reports both DuneSlide vulnerabilities (CVE-2026-50548 and CVE-2026-50549) to Anysphere.
  • Anysphere initially rejects the reports, stating MCP-misuse scenarios fall outside Cursor's stated threat model.
  • Cato AI Labs escalates the findings; Anysphere reopens and triages both reports.
  • Cursor 3.0 is released, fixing both the working_directory sandbox-write flaw (CVE-2026-50548) and the symlink-resolution fallback flaw (CVE-2026-50549).
  • CVE-2026-50548 and CVE-2026-50549 are formally assigned, alongside GitHub Security Advisories GHSA-3p48-7v9f-v5cw and GHSA-3v8f-48vw-3mjx.
  • Cato AI Labs states responsible disclosure of the underlying sandbox/path-validation weakness class is ongoing across other AI coding agents beyond Cursor, and argues sandboxing alone cannot contain autonomous coding-agent risk without architecture-level, parameter-validation defenses.
  • The Hacker News, CyberScoop, SecurityWeek, and CybersecurityNews publish full technical details of the DuneSlide vulnerabilities; no in-the-wild exploitation has been confirmed.

Sources cited for Critical Cursor AI Code Editor Flaws (CVE-2026-50548

Threats related to Critical Cursor AI Code Editor Flaws (CVE-2026-50548

Detection coverage for TL-2026-1049

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1049 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats