DuneSlide Flaws in Cursor IDE Enable Zero-Click Sandbox Escape and RCE

Cato AI Labs disclosed two critical vulnerabilities in the Cursor AI code editor, dubbed DuneSlide, that can let attackers escape the product’s terminal sandbox and achieve arbitrary code execution through zero-click prompt injection. The flaws, tracked as CVE-2026-50548 and CVE-2026-50549 and rated CVSS 9.8, affect Cursor versions before 3.0. Researchers said malicious instructions hidden in attacker-controlled content—such as poisoned web search results or responses from MCP-connected services—could be ingested by Cursor and trigger exploitation without deliberate user interaction.

The first vulnerability abuses the LLM-controlled working_directory parameter in the run_terminal_cmd tool to write outside the project root, while the second exploits a symlink canonicalization failure that can bypass path validation when destination resolution fails. Researchers showed the bugs could be used to overwrite the cursorsandbox helper and other sensitive files, causing later commands to run with the user’s privileges and potentially exposing the local machine as well as connected cloud and SaaS workspaces. Cursor said the issues were patched in version 3.0, released on April 2, and reports said there is currently no evidence of active exploitation.