Beware: Cursor DuneSlide — Two Critical RCE Vulnerabilities (CVE-2026-50548, CVE-2026-50549) Let Attackers Escape the Sandbox via Zero-Click Prompt Injection

TL;DR: Cato AI Labs discovered two independent critical remote code execution (RCE) vulnerabilities in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549 (both CVSS 9.8). Together dubbed “DuneSlide,” these flaws allow attackers to escape Cursor’s sandbox via zero-click prompt injection — simply by getting you to open a repository or interact with a poisoned MCP server. Fixed in Cursor 3.0 (released April 2, 2026). Upgrade immediately.

What Happened

Cursor 2.x shipped with “Auto-Run Mode” enabled by default — the AI agent can execute terminal commands inside a sandbox without asking for approval. This sandbox was supposed to prevent prompt injection from turning into RCE.

Cato AI Labs found two completely independent architectural flaws that let attackers bypass this sandbox:

Vulnerability #1: Working Directory Parameter Manipulation (CVE-2026-50548)

When Cursor’s sandbox executes a command, it builds a Seatbelt policy (macOS sandbox) allowing writes to the current working directory. The problem: the working_directory parameter of the run_terminal_cmd tool is optional and attacker-controllable.

1. A prompt injection (via a malicious MCP server response, poisoned web search result, or compromised repository) steers the LLM to set working_directory to a sensitive path outside the project — like /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox
2. That path gets blindly added to the sandbox’s allowed-write list
3. The attacker overwrites the cursorsandbox binary itself
4. All subsequent commands in the same session run WITHOUT sandbox restrictions → full RCE

Other vulnerable paths include ~/.zshrc, ~/.zshenv, ~/Library/LaunchAgents — any file that gives persistence or code execution.

Vulnerability #2: Symlink Canonicalization Failure (CVE-2026-50549)

This is a completely separate bug in Cursor’s file path resolution:

1. Prompt injection instructs the Cursor Agent to create a symlink inside the project directory pointing to a sensitive file outside (e.g., the cursorsandbox binary)
2. Cursor attempts to canonicalize (resolve) the symlink to check if the true destination is within project bounds
3. Critical flaw: If canonicalization fails (path doesn’t exist, permission denied on a parent directory), Cursor falls back to the original symlink path — treating it as “safe” because it’s inside the project
4. Attacker creates a write-only symlink (target lacks read permissions) → canonicalization fails → Cursor allows the write
5. Attacker overwrites cursorsandbox through the symlink → sandbox disabled → RCE

In traditional software, remote attackers can’t create symlinks on your machine. Prompt injection turns the Cursor agent into the attacker’s hands.

Who Is Affected

Attack vector requires NO user interaction beyond: opening a repository, accepting an MCP server result, or viewing a poisoned web search result. The exploit runs automatically within the same agent session.

How to Check If You’re Vulnerable

1. Check Your Cursor Version

# macOS / Linux
cursor --version

# Windows (PowerShell)
cursor --version

# Or via the UI: Cursor → About Cursor

If version < 3.0.0 → YOU ARE VULNERABLE.

2. Check if Auto-Run Mode Is Enabled (Default in 2.x)

# Check Cursor settings (JSON)
cat ~/Library/Application\ Support/Cursor/User/settings.json | grep -i "auto.run\|agent.autoRun"

Look for "agent.autoRun": true or similar. In Cursor 2.x, this defaults to true.

3. Verify the cursorsandbox Binary Integrity (macOS)

# Check if cursorsandbox has been modified
ls -la "/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox"

# Expected: owned by root, not recently modified
# Suspicious: owned by your user, recent modification time, different size

4. Check for Suspicious Symlinks in Your Projects

# Scan all Cursor projects for symlinks pointing outside
find ~/projects -type l -exec sh -c '
  for link; do
    target=$(readlink "$link")
    if [[ "$target" != /* ]]; then
      target=$(realpath "$(dirname "$link")/$target")
    fi
    if [[ ! "$target" =~ ^$(realpath ~/projects) ]]; then
      echo "EXTERNAL SYMLINK: $link -> $target"
    fi
  done
' sh {} +

5. Check Shell RC Files for Unexpected Changes

# Check modification times
stat ~/.zshrc ~/.zshenv ~/.bashrc ~/.bash_profile 2>/dev/null

# Look for Cursor-related additions
grep -n "cursor\|Cursor" ~/.zshrc ~/.zshenv ~/.bashrc ~/.bash_profile 2>/dev/null

How to Protect Yourself

Immediate Action: Upgrade to Cursor 3.0+

# macOS: Download from cursor.com or use auto-update
# Cursor → Check for Updates

# Linux: Re-download AppImage or use package manager
# Windows: Re-download installer from cursor.com

Cursor 3.0 (released April 2, 2026) patches both vulnerabilities. CVE IDs were assigned June 5, 2026.

If You Cannot Upgrade Immediately

1. Disable Auto-Run Mode:

   • Settings → AI Agent → Auto-Run Mode → Disabled or Manual Approval Required

2. Block Network Access to Cursor’s Helper Processes:

   # macOS: Use Little Snitch / LuLu to block cursorsandbox outbound
   # Linux: firejail --net=none cursor
   # Windows: Windows Defender Firewall block cursorsandbox.exe

3. Run Cursor in a VM or Container:

   # Example: Docker with restricted capabilities
   docker run -it --rm \
     --security-opt no-new-privileges \
     --cap-drop=ALL \
     -v ~/projects:/workspace \
     cursor-image

4. Treat Untrusted Repositories as Hostile:

   • Don’t open random GitHub repos in Cursor
   • Audit MCP server configurations
   • Disable web search in agent if not needed

For Security Teams

Is There a Fix?

YES. Both vulnerabilities are fixed in Cursor 3.0 (released April 2, 2026).

Disclosure Timeline

What the Fixes Address

• CVE-2026-50548: Working directory parameter validation — sandbox policy no longer blindly trusts LLM-supplied paths
• CVE-2026-50549: Symlink canonicalization — proper fallback handling, write-through-symlink protection

Why This Matters for the AI Coding Ecosystem

DuneSlide isn’t just a Cursor bug — it’s a class of vulnerability inherent to giving LLMs autonomous command execution:

1. Sandboxing is necessary but not sufficient — parameter validation and path resolution edge cases become attack surface
2. Zero-click prompt injection is real — MCP servers, web search, repo contents are all injection vectors
3. The agent IS the attack bridge — the very autonomy that makes these tools useful makes them dangerous
4. Vendor response matters — 7 weeks from report to fix commitment, but initial rejection shows threat model gaps

Cato AI Labs notes they’re “in the process of responsibly disclosing vulnerabilities in all popular coding agents” — expect similar findings in Claude Code, Codex, Windsurf, and others.

Summary Checklist

• Upgrade to Cursor 3.0+ immediately (primary fix)
• Verify version with cursor --version
• Disable Auto-Run Mode if staying on 2.x temporarily
• Scan projects for external symlinks
• Check cursorsandbox binary integrity
• Review shell RC files for unauthorized changes
• Audit configured MCP servers
• Enable endpoint monitoring for Cursor processes

References

• Cato AI Labs: DuneSlide — Two Critical RCE Vulnerabilities
• CVE-2026-50548
• CVE-2026-50549
• GitHub Security Advisory GHSA-82wg-qcm4-fp2w
• SecurityWeek: Critical Cursor AI IDE Flaws

Related articles

• Claude Code Alternatives in 2026: 12 Options Compared
• Beware: Hermes Agent Security Audit Uncovers Credential Bypass, Sandbox Escape, and Session Hijacking in 5 HIGH-Severity Findings
• Context Engineering for Coding Agents: How to Make Every Token Count

This article is part of our Beware series — critical security vulnerabilities in AI coding tools with actionable mitigation guidance. If you use Cursor, upgrade today.