DuneSlide: Two Critical RCE vulnerabilities

Summary

Cato AI Labs disclosed DuneSlide, a pair of critical remote-code-execution vulnerabilities in the Cursor AI code editor tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 on CVSS (9.3 under CVSS 4.0). A single ordinary-looking prompt can break the agent out of Cursor's terminal-command sandbox and run arbitrary commands on a developer's machine with no click and no approval prompt.^[0][2]

Both flaws follow the same pattern: prompt injection delivered through content the agent reads on the user's behalf (such as a Model Context Protocol service or a web-search result) coerces the agent into writing a single file it should not be allowed to write, then uses that write to disable the sandbox and gain full RCE on the host and any connected cloud or SaaS workspaces.^[0][2]

This is disclosed as research, not observed in-the-wild activity: Cato characterizes it as research rather than an active campaign, and the public vulnerability record shows no known exploitation. The bugs are already fixed in Cursor 3.0 (released April 2); every version before 3.0 is affected.^[0]

Attack chain

1. Prompt injection delivery: An attacker plants hidden instructions in content the Cursor agent reads on the user's behalf, such as a connected service via the Model Context Protocol (MCP) or a page returned by a web search. The user asks a normal question and the injected instructions ride along, making the attack zero-click.^[0]
2. Coerced arbitrary file write: The injected instructions steer the agent into writing one file it should not be allowed to write. In CVE-2026-50548 the agent sets the optional working_directory parameter on the run_terminal_cmd tool to a non-default path, which Cursor adds to the allowed-write list without validation. In CVE-2026-50549 the attacker plants a symlink pointing outside the project and forces Cursor's symlink safety check to fail, causing Cursor to fall back to trusting the in-project path and write straight through the shortcut.^[0]
3. Sandbox neutralization: The coerced write overwrites the sandbox helper binary itself (on macOS, /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox), or a startup file such as ~/.zshrc, so subsequent commands run with no sandbox at all.^[0]
4. Unsandboxed remote code execution: With the sandbox neutralized, the next command runs as the user, giving control of the developer's machine plus any cloud or SaaS workspaces the editor is signed into.^[0][2]

Disclosure timeline

How it works

CVE-2026-50548 abuses a configuration behavior. Cursor's sandbox permits writes into a command's working folder, and that folder is set by the optional working_directory parameter on Cursor's run_terminal_cmd tool. When the agent sets it to a non-default path, Cursor adds that path to the allowed-write list without validation. Injected instructions point it at a system file instead of the project, allowing overwrite of the sandbox helper (cursorsandbox on macOS) or startup files like ~/.zshrc, after which later commands run with no sandbox.^[0]

CVE-2026-50549 abuses a flawed safety check. Before writing, Cursor resolves symlinks to confirm the real destination is inside the project. The vulnerable fallback: when the check fails because the target does not exist or the attacker removes read access from a folder in the path, Cursor gives up and trusts the shortcut's in-project path instead. An attacker creates a symlink pointing outside the project, forces the check to fail, and Cursor writes through it to the same sandbox helper, achieving the same escape.^[0]

Both flaws demonstrate how prompt injection can reach beyond the LLM layer and expose classical vulnerabilities in code paths not traditionally considered part of the attack surface, converting sandboxed commands into unsandboxed RCE and leading to full compromise of the host and connected SaaS workspaces.^[2]

Affected versions and patch status

Key takeaways

• DuneSlide shows that sandboxing an AI agent's terminal commands is not sufficient when prompt injection can coerce a single unauthorized file write that neutralizes the sandbox itself.^[0][2]
• Prompt injection can expose classical file-handling vulnerabilities (permissive working-directory handling and unsafe symlink-check fallbacks) in code paths not previously treated as attack surface.^[0][2]
• DuneSlide is the latest in a run of Cursor bugs that begin with a poisoned prompt and end in code execution, each defeating a different guardrail; Cato says it is disclosing similar flaws in other coding agents and frames the issue as structural rather than a string of one-offs.^[0]
• There is no evidence of in-the-wild exploitation; the fix is already available, so patching is the primary action.^[0]

Defensive actions

• Update Cursor to version 3.0 or later.: Both DuneSlide vulnerabilities are patched in Cursor 3.0; every earlier version is affected, and the tool is widely deployed (over half the Fortune 500 per Cursor).^[0]
• Treat content read by the AI agent (MCP services, web-search results) as untrusted input.: The attack vector is prompt injection planted in content the agent reads on the user's behalf, requiring no user click or approval; Cato argues the problem is structural across coding agents that read the open web.^[0]