Loading story…
Cato AI Labs disclosed two critical vulnerabilities in the Cursor AI code editor, dubbed DuneSlide, that can let attackers escape the product’s terminal sandbox and achieve arbitrary code execution through zero-click prompt injection. The flaws, tracked as CVE-2026-50548 and CVE-2026-50549 and rated CVSS 9.8, affect Cursor versions before 3.0. Researchers said malicious instructions hidden in attacker-controlled content—such as poisoned web search results or responses from MCP-connected services—could be ingested by Cursor and trigger exploitation without deliberate user interaction.
The first vulnerability abuses the LLM-controlled working_directory parameter in the run_terminal_cmd tool to write outside the project root, while the second exploits a symlink canonicalization failure that can bypass path validation when destination resolution fails. Researchers showed the bugs could be used to overwrite the cursorsandbox helper and other sensitive files, causing later commands to run with the user’s privileges and potentially exposing the local machine as well as connected cloud and SaaS workspaces. Cursor said the issues were patched in version 3.0, released on April 2, and reports said there is currently no evidence of active exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cato Networks reported the two DuneSlide vulnerabilities, CVE-2026-50548 and CVE-2026-50549, to Cursor in February 2026. This vendor notification preceded the April 2 release of Cursor 3.0 containing fixes.
Cato AI Labs disclosed two critical remote code execution vulnerabilities in Cursor IDE, dubbed DuneSlide, that allow prompt injection to escape the sandbox and achieve arbitrary command execution. The flaws are tracked as CVE-2026-50548 and CVE-2026-50549, and the reporting notes no evidence of active exploitation.
The two critical Cursor IDE vulnerabilities, CVE-2026-50548 and CVE-2026-50549, were patched in Cursor version 3.0. The source states Cursor 3.0 was released on April 2 and that versions before 3.0 are affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two critical vulnerabilities in the Cursor AI code editor, collectively named **DuneSlide** and tracked as `CVE-2026-50548` and `CVE-2026-50549`, that allow zero-click prompt-injection attacks to escape the IDE sandbox and achieve remote code execution on the underlying operating system. Both flaws carry a **CVSS 9.8** rating and affect Cursor versions prior to **3.0**, with exploitation enabling arbitrary file writes on a victim’s local system and potential compromise of linked SaaS workspaces. The attack chain abuses Cursor’s agent terminal command handling through working-directory manipulation and a symlink-based path resolution bypass, allowing attackers to overwrite the `cursorsandbox` helper and run arbitrary commands with the user’s privileges outside the sandbox. The issues were responsibly disclosed in February 2026 and fixed in Cursor **3.0**, released on April 2, 2026; while no active exploitation had been confirmed at publication, reporting warned the technique is highly automatable and organizations were urged to upgrade immediately and review any untrusted prompts or files processed before patching.
Jul 7, 2026
Researchers disclosed two separate high-severity security issues affecting the **Cursor** AI development environment, showing how developer workstations can be compromised through both malicious repositories and rogue extensions. Novee reported `CVE-2026-26268` (CVSS 8.1), an arbitrary code execution flaw that can be triggered when a developer clones a crafted repository and Cursor’s AI agent performs routine Git actions such as checkout. The attack hides a malicious pre-commit hook inside a nested bare repository, allowing code to run locally without warning or additional user approval. Cursor worked with the researchers on a fix that was completed in February 2026, and defenders were urged to update to the patched version and inspect repositories for embedded bare directories and suspicious Cursor Rules files. A separate LayerX report found that any installed Cursor extension could access API keys and session tokens stored in a local SQLite database because the product did not isolate extensions from that credential store or use protected OS-backed secret storage. A malicious or compromised extension could silently exfiltrate credentials for Cursor services and third-party integrations including **OpenAI**, **Anthropic**, and **Google**, enabling account takeover, impersonation, data theft, and financial abuse. As of the report’s publication, LayerX said the extension issue remained unpatched and recommended moving secrets into encrypted system keychains and enforcing stricter extension isolation.
Jun 29, 2026
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 14, 2026