Loading story…
Researchers disclosed two critical vulnerabilities in the Cursor AI code editor, collectively named DuneSlide and tracked as CVE-2026-50548 and CVE-2026-50549, that allow zero-click prompt-injection attacks to escape the IDE sandbox and achieve remote code execution on the underlying operating system. Both flaws carry a CVSS 9.8 rating and affect Cursor versions prior to 3.0, with exploitation enabling arbitrary file writes on a victim’s local system and potential compromise of linked SaaS workspaces.
The attack chain abuses Cursor’s agent terminal command handling through working-directory manipulation and a symlink-based path resolution bypass, allowing attackers to overwrite the cursorsandbox helper and run arbitrary commands with the user’s privileges outside the sandbox. The issues were responsibly disclosed in February 2026 and fixed in Cursor 3.0, released on April 2, 2026; while no active exploitation had been confirmed at publication, reporting warned the technique is highly automatable and organizations were urged to upgrade immediately and review any untrusted prompts or files processed before patching.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cato AI Labs disclosed technical details of the DuneSlide flaws, explaining that parameter manipulation in sandbox policy generation and symlink-based path resolution issues could enable arbitrary file writes and remote code execution. The disclosure also warned that exploitation could impact both local devices and linked SaaS workspaces.
The two critical Cursor IDE vulnerabilities later dubbed DuneSlide were responsibly disclosed in February 2026. The flaws affect Cursor versions prior to 3.0 and enable sandbox escape and zero-click remote code execution.
The two Cursor vulnerabilities were assigned and published on 2026-06-24 as CVE-2026-50548 and CVE-2026-50549. They were rated critical and described as enabling zero-click prompt-injection-driven compromise of the host system.
Cursor released version 3.0 on 2026-04-02, fixing CVE-2026-50548 and CVE-2026-50549. The update addressed the vulnerabilities that allowed arbitrary file writes, sandbox escape, and code execution outside the IDE sandbox.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcethreataft.com
Open sourcecyberveille.ch
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cato AI Labs disclosed two critical vulnerabilities in the Cursor AI code editor, dubbed **DuneSlide**, that can let attackers escape the product’s terminal sandbox and achieve arbitrary code execution through **zero-click prompt injection**. The flaws, tracked as `CVE-2026-50548` and `CVE-2026-50549` and rated **CVSS 9.8**, affect Cursor versions before **3.0**. Researchers said malicious instructions hidden in attacker-controlled content—such as poisoned web search results or responses from MCP-connected services—could be ingested by Cursor and trigger exploitation without deliberate user interaction. The first vulnerability abuses the LLM-controlled `working_directory` parameter in the `run_terminal_cmd` tool to write outside the project root, while the second exploits a symlink canonicalization failure that can bypass path validation when destination resolution fails. Researchers showed the bugs could be used to overwrite the `cursorsandbox` helper and other sensitive files, causing later commands to run with the user’s privileges and potentially exposing the local machine as well as connected cloud and SaaS workspaces. Cursor said the issues were patched in version **3.0**, released on April 2, and reports said there is currently no evidence of active exploitation.
Jul 3, 2026
Researchers disclosed two separate high-severity security issues affecting the **Cursor** AI development environment, showing how developer workstations can be compromised through both malicious repositories and rogue extensions. Novee reported `CVE-2026-26268` (CVSS 8.1), an arbitrary code execution flaw that can be triggered when a developer clones a crafted repository and Cursor’s AI agent performs routine Git actions such as checkout. The attack hides a malicious pre-commit hook inside a nested bare repository, allowing code to run locally without warning or additional user approval. Cursor worked with the researchers on a fix that was completed in February 2026, and defenders were urged to update to the patched version and inspect repositories for embedded bare directories and suspicious Cursor Rules files. A separate LayerX report found that any installed Cursor extension could access API keys and session tokens stored in a local SQLite database because the product did not isolate extensions from that credential store or use protected OS-backed secret storage. A malicious or compromised extension could silently exfiltrate credentials for Cursor services and third-party integrations including **OpenAI**, **Anthropic**, and **Google**, enabling account takeover, impersonation, data theft, and financial abuse. As of the report’s publication, LayerX said the extension issue remained unpatched and recommended moving secrets into encrypted system keychains and enforcing stricter extension isolation.
Jun 29, 2026
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 15, 2026