Summary
Two critical vulnerabilities in the Cursor AI code editor, collectively dubbed “DuneSlide” by researchers at Cato AI Labs, allow a single prompt injection to escape the editor’s safety sandbox and execute arbitrary commands on a developer’s machine — with zero clicks required. Tracked as CVE-2026-50548 and CVE-2026-50549, both carry a CVSS score of 9.8. The flaws are patched in Cursor 3.0 (released April 2), and all prior versions are affected.
CVE-2026-50548 exploits the working_directory parameter of Cursor’s run_terminal_cmd tool. The sandbox permits writes into a command’s working folder, but when the AI agent sets this to a non-default path, Cursor adds it to the allowed-write list without validation — enabling an attacker to overwrite the cursorsandbox binary itself and disable sandboxing entirely. CVE-2026-50549 abuses a symlink resolution fallback: when Cursor’s path canonicalization fails, it trusts the un-resolved symlink path, allowing writes to arbitrary locations outside the project.
The attack vector is prompt injection via untrusted sources like malicious MCP servers or poisoned web search results. Once the sandbox is neutralized, subsequent commands run with full user privileges, compromising the developer’s machine and any connected cloud or SaaS workspaces.
Source
The Hacker News · Cato AI Labs · SecurityWeek
Commentary
DuneSlide is a case study in why AI agent sandboxing is hard. Both vulnerabilities exploit edge cases in perfectly reasonable security checks — a legitimate parameter that becomes a write-list bypass, and a symlink resolution fallback that trusts unverified paths. The fact that exploitation is zero-click and triggered through normal AI agent behavior (reading from MCP servers or web searches) makes this especially dangerous.
With Cursor claiming more than half the Fortune 500 as users, the attack surface is massive. This research also has broader implications: every AI coding assistant that runs terminal commands inside a sandbox needs to ask whether its allow-listing logic handles adversarial working directories and symlink edge cases. If your sandboxing can be disabled by overwriting its own binary, you don’t have a sandbox — you have a suggestion.