DuneSlide in Cursor IDE: When One Prompt Becomes Full RCE
DuneSlide is a pair of critical prompt injection vulnerabilities in Cursor IDE that allow a single, ordinary-looking AI prompt to escape the editor’s sandbox and execute arbitrary system commands as the developer, turning sandboxed terminal operations into full remote code execution without any additional clicks or confirmations. That is the headline risk: Cursor IDE security was supposed to rely on a sandbox that kept AI-issued commands in a locked box, but DuneSlide is all about breaking out of that box. These flaws, tracked as CVE-2026-50548 and CVE-2026-50549 and collectively rated 9.8 under CVSS, show that prompt injection vulnerabilities now reach beyond manipulating model output into traditional code paths previously treated as safe. For developers who depend on AI-powered code editors and untrusted prompts or code, this is not a theoretical corner case; it is an architectural warning.
How Zero-Click Prompt Injection Escapes Cursor’s Sandbox
Cursor introduced its sandbox in the 2.x line so that terminal commands issued by the AI agent would run inside a restricted environment, limiting what they could touch and preventing stray instructions from damaging the machine. DuneSlide shows that this guardrail can be turned off by poisoned input the user never sees. The way in is prompt injection: attackers plant hidden instructions in something the agent reads on the user’s behalf, such as content from a Model Context Protocol service or a web page result. You ask a normal coding question, those instructions ride along, and the exploit triggers with no click or approval, making it a zero-click attack. Once the injected logic convinces Cursor to write one file it should never touch and thereby disable the sandbox, the next terminal command runs as fully unsandboxed RCE, compromising both the local machine and any connected SaaS workspaces.
Inside CVE-2026-50548 and CVE-2026-50549: Two Doors Out of the Box
Both DuneSlide vulnerabilities use the same basic strategy: force the AI agent to write to a forbidden location and flip the sandbox off. CVE-2026-50548 abuses the working_directory parameter on Cursor’s run_terminal_cmd tool. The sandbox allows writes inside the command’s working folder; when the agent sets this parameter to a non-default path, Cursor blindly adds that path to the allowed-write list. Injected instructions can redirect it to critical system files, including the cursorsandbox helper binary at /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox on macOS, or user startup files like ~/.zshrc, turning future commands into unsandboxed execution. CVE-2026-50549 instead abuses the symlink safety check. Cursor intends to resolve shortcuts and verify the real destination stays inside the project, but when that resolution fails—either because the file does not exist or read access is removed—it trusts the apparent in-project path and writes through a crafted shortcut straight to the same sandbox helper.
Impact, Patch Timeline, and What Cursor Users Must Do
With the sandbox disabled, subsequent commands run with the developer’s full privileges, giving attackers control over the machine and any cloud or SaaS workspaces the editor is signed into—all from one harmless-looking prompt. Both CVE-2026-50548 and CVE-2026-50549 are rated 9.8 out of 10 (9.3 under CVSS 4.0), underscoring how severe RCE command execution via sandbox escape attacks has become. The good news is that Cursor has shipped fixes: both bugs are patched in Cursor 3.0, released April 2, and every version before 3.0 is affected. Cato AI Labs reported the issues on February 19; after an initial rejection, Cursor reopened the reports on February 26, triaged them, and delivered the patch in 3.0, with CVE IDs assigned June 5. There is no sign of real-world exploitation yet; the research is public, but the advisory record shows no known attacks as of publication. Still, with more than half the Fortune 500 using Cursor, anyone running pre-3.0 builds needs to update now.
What DuneSlide Tells Us About AI Code Editor Security
DuneSlide is not an isolated bug; it is the latest entry in a line of Cursor IDE security failures where a poisoned prompt leads all the way to code execution, defeating a different guardrail each time. Earlier flaws such as CurXecute (CVE-2025-54135), MCPoison (CVE-2025-54136), and a booby-trapped Git hook vulnerability (CVE-2026-26268) were supposed to be answered by the introduction of the sandbox in the 2.x releases. Now we know that answer can be escaped. As one quotable summary from the research puts it, these vulnerabilities “demonstrate that prompt injection attacks can extend beyond manipulating an LLM’s output and reach into classical code paths never previously considered part of the attack surface.” The uncomfortable lesson is that any AI agent reading from the open web or connected services must treat every input as hostile by default. Relying on patch-by-patch fixes for prompt injection vulnerabilities is no longer enough; secure design for AI coding agents has to assume that every suggestion, every doc page, and every MCP response might be trying to turn sandboxed help into unsandboxed RCE command execution.
