Cursor DuneSlide: Critical RCE Flaws in the AI Code Editor (CVE-2026-50548 & CVE-2026-50549)

<article id="post-1329" class="single-content card-layout-w post-1329 post type-post status-publish format-standard hentry category-coding category-security category-technology tag-ai-security tag-cursor tag-cve-2026-50548 tag-cve-2026-50549 tag-duneslide tag-prompt-injection tag-rce"> <div class="single-hero-inside"><div class="single-hero-1"> <div class="single-hero-title"> <div class="category"> <a class="term-id-19" href="https://tekmag.thsite.top/category/coding/" title="Coding"><span>Coding</span></a><a class="term-id-16" href="https://tekmag.thsite.top/category/security/" title="Security"><span>Security</span></a><a class="term-id-10" href="https://tekmag.thsite.top/category/technology/" title="Technology"><span>Technology</span></a> </div> <h1 class="title"><span class="title-span">Cursor DuneSlide: Critical RCE Flaws in the AI Code Editor (CVE-2026-50548 &amp; CVE-2026-50549)</span></h1> <div class="single-hero-meta"> <div class="meta-2"> <div class="top"><span class="author-by">By </span><a target="_blank" class="author-name" href="https://tekmag.thsite.top/author/hamza-chahid/">Hamza Chahid</a></div> <div class="bottom"><span class="meta-item date">July 15, 2026</span><span class="meta-item reading-time">3 Min Read</span></div> </div> <div class="meta-3"><span class="meta-item comments"><span class="count">0</span></span></div> </div> </div> </div> <div class="single-content-inner"> <p><strong>Two critical remote code execution vulnerabilities in Cursor IDE — tracked as CVE-2026-50548 and CVE-2026-50549 and collectively named DuneSlide — allow attackers to escape the editor’s agent sandbox with zero clicks through poisoned web results, malicious MCP servers, or crafted repository files. Every Cursor 2.x release is affected, and the bugs carry a CVSS 9.8 severity rating.</strong></p> <p>Disclosed on July 1, 2026 by Cato Networks’ Cato AI Labs, the DuneSlide vulnerabilities represent the fourth prompt-injection RCE class reported against Cursor since August 2025. Cursor is used by over 50% of Fortune 500 companies and has more than 7 million active users as of mid-2026. The bugs were silently patched in Cursor 3.0, released April 2, 2026, three months before public disclosure.</p> <h2>What Makes DuneSlide Different From Previous Cursor Bugs</h2> <p>Earlier issues like CurXecute, MCPoison, and the February 2026 Git-hook injection each required specific user actions or narrow conditions. DuneSlide is different: both vulnerabilities can be triggered without any user click or approval. An attacker only needs to place poisoned content where Cursor’s agent will ingest it — a compromised MCP server response, a search result from Cursor’s built-in web browsing, or a crafted file inside a repository the developer opens.</p> <p>Microsoft documented prompt injection attacks as “shell-equivalent” in a May 2026 security advisory, and DuneSlide proves the point concretely. The attack surface is structural — Cato AI Labs has disclosed similar sandbox-escaping flaws in other AI coding agents, suggesting this is not a Cursor-specific problem but a design weakness across the category.</p> <h2>CVE-2026-50548: The working_directory Bypass</h2> <p>Cursor’s agent exposes a <code>run_terminal_cmd</code> tool that accepts an optional <code>working_directory</code> parameter, controlled entirely by the LLM. The sandbox is supposed to restrict file writes to within the project directory, but the validation never checks whether the resolved path stays inside the project root.</p> <p>A poisoned prompt can instruct the agent to set <code>working_directory</code> to an out-of-project sensitive path. On macOS, the prime target is <code>/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox</code> — overwriting this file with attacker-controlled content disables all subsequent sandbox enforcement, allowing full shell access in follow-up commands. Shell startup files like <code>~/.zshrc</code> or <code>~/.bashrc</code> are also reachable through the same mechanism.</p> <h2>CVE-2026-50549: The Symlink Resolution Fallback</h2> <p>Before writing a file, Cursor resolves symlinks to confirm the real path is inside the project directory. The flaw is in the fallback behavior: when resolution fails — because the target is missing, or read permissions have been removed — Cursor trusts the in-project symlink path anyway.</p> <p>An attacker creates a symlink inside the repository pointing to an external file, then arranges for the resolution to fail. Cursor writes through the symlink to the attacker’s chosen destination, which can again be the sandbox helper binary, startup scripts, or any other writable OS location. The two CVEs can be chained for higher reliability.</p> <h2>What This Means for Cursor Users</h2> <p>If you are still on Cursor 2.x, update to version 3.0 or later immediately — the fix has been available since April 2, 2026. After updating, take these additional steps:</p> <ul> <li><strong>Audit your MCP servers.</strong> Any compromised or untrusted MCP endpoint can inject commands that trigger the sandbox escape. Remove servers you do not actively use.</li> <li><strong>Disable web search in agent mode</strong> if your workflow does not strictly need it. Poisoned search results are one of the three confirmed entry vectors.</li> <li><strong>Avoid opening untrusted repositories</strong> with Cursor’s agent features enabled. A malicious <code>.cursor/rules</code> file, <code>README</code>, or MCP configuration file inside a repo can trigger DuneSlide on clone or open.</li> <li><strong>For enterprise teams:</strong> enforce a minimum Cursor version via MDM, prefer dev containers or GitHub Codespaces for sensitive projects, and audit MCP server permissions at the organizational level.</li> </ul> <p>The broader lesson is that prompt injection is no longer a theoretical nuisance — it is a practical code execution vector that demands the same security discipline as traditional remote code execution. Treat any data channel that reaches your coding agent (web content, MCP responses, file contents) as untrusted input, and sandbox accordingly.</p> <h2>References</h2> <ol> <li><a href="https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/" target="_blank" rel="noopener noreferrer">DuneSlide: Two Critical RCE Vulnerabilities — Cato AI Labs</a></li> <li><a href="https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html" target="_blank" rel="noopener noreferrer">Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox — The Hacker News</a></li> <li><a href="https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html" target="_blank" rel="noopener noreferrer">Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector — CSO Online</a></li> <li><a href="https://byteiota.com/cursor-duneslide-prompt-injection-rce-in-cve-2026-50548/" target="_blank" rel="noopener noreferrer">Cursor DuneSlide: Prompt Injection RCE in CVE-2026-50548 — Byteiota</a></li> <li><a href="https://www.apolocybersecurity.com/en/blog-posts/duneslide-cursor-vulnerabilities-cve-2026-50548-cve-2026-50549-prompt-injection-sandbox" target="_blank" rel="noopener noreferrer">DuneSlide: Two Critical Cursor Flaws — Apolo Cybersecurity</a></li> </ol> <div class="simplesocialbuttons simplesocial-simple-round simplesocialbuttons_inline simplesocialbuttons-align-left post-1329 post simplesocialbuttons-inline-no-animation"> <button class="simplesocial-fb-share" rel="nofollow" target="_blank" aria-label="Facebook Share" data-href="https://www.facebook.com/sharer/sharer.php?u=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="javascript:window.open(this.dataset.href, '', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');return false;"><span class="simplesocialtxt">Facebook </span> </button> <button class="simplesocial-twt-share" rel="nofollow" target="_blank" aria-label="Twitter Share" data-href="https://twitter.com/intent/tweet?text=Cursor+DuneSlide%3A+Critical+RCE+Flaws+in+the+AI+Code+Editor+%28CVE-2026-50548+%26+CVE-2026-50549%29&amp;url=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="javascript:window.open(this.dataset.href, '', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');return false;"><span class="simplesocialtxt">Twitter</span> </button> <button rel="nofollow" target="_blank" class="simplesocial-linkedin-share" aria-label="LinkedIn Share" data-href="https://www.linkedin.com/sharing/share-offsite/?url=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="javascript:window.open(this.dataset.href, '', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');return false;"><span class="simplesocialtxt">LinkedIn</span></button> <button onclick="javascript:window.open(this.dataset.href, '_blank' );return false;" class="simplesocial-whatsapp-share" rel="nofollow" target="_blank" aria-label="WhatsApp Share" data-href="https://api.whatsapp.com/send?text=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/"><span class="simplesocialtxt">WhatsApp</span></button> <button class="simplesocial-threads-share" rel="nofollow" target="_blank" aria-label="Threads Share" data-href="https://www.threads.net/intent/post?text=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="javascript:window.open(this.dataset.href, '', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');return false;"><span class="simplesocialtxt">Threads </span> </button> <button class="simplesocial-telegram-share" rel="nofollow" target="_blank" aria-label="Telegram Share" data-href="https://t.me/share/url?url=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="javascript:window.open(this.dataset.href, '', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');return false;"><span class="simplesocialtxt">Telegram </span> </button> <button onclick="javascript:window.location.href = this.dataset.href;return false;" class="simplesocial-email-share" aria-label="Share through Email" rel="nofollow" target="_blank" data-href="mailto:?subject=Cursor+DuneSlide%3A+Critical+RCE+Flaws+in+the+AI+Code+Editor+%28CVE-2026-50548+%26+CVE-2026-50549%29&amp;body=https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/"><span class="simplesocialtxt">Email</span></button> <div class="fb-like ssb-fb-like fb_iframe_widget" aria-label="Facebook Like" data-href="https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/"><span style="vertical-align: bottom; width: 0px; height: 0px;"><iframe name="ffde0184415f32b3c" width="1000px" height="1000px"></iframe></span></div> <button class="simplesocial-copy-link copy-share" rel="nofollow" target="_blank" aria-label="Copy Link" data-href=" https://tekmag.thsite.top/cursor-duneslide-critical-rce-flaws-in-the-ai-code-editor-cve-2026-50548-cve-2026-50549/" onclick="ssb_copy_share_link(this); return false;"><span class="simplesocialtxt">Copy</span><span class="ssb_tooltip">Copied</span> </button> </div> <div class="clear"></div> <div class="single-post-tags"><h4>Tags:</h4> <a href="https://tekmag.thsite.top/tag/ai-security/" rel="tag">AI Security</a><a href="https://tekmag.thsite.top/tag/cursor/" rel="tag">Cursor</a><a href="https://tekmag.thsite.top/tag/cve-2026-50548/" rel="tag">CVE-2026-50548</a><a href="https://tekmag.thsite.top/tag/cve-2026-50549/" rel="tag">CVE-2026-50549</a><a href="https://tekmag.thsite.top/tag/duneslide/" rel="tag">DuneSlide</a><a href="https://tekmag.thsite.top/tag/prompt-injection/" rel="tag">Prompt Injection</a><a href="https://tekmag.thsite.top/tag/rce/" rel="tag">RCE</a> </div> <h4>Tags:</h4> AI Security Cursor CVE-2026-50548 CVE-2026-50549 DuneSlide Prompt Injection RCE </div> </article>