Disclosed vulnerability
DuneSlide: zero-click prompt injection escapes the Cursor sandbox for OS-level code execution
AIR-2026-0149 AIR record · 2026-04-cursor-duneslide
From the supporting source
Cato AI Labs found the pair and named them DuneSlide. They are tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10.thehackernews.com
The record
Disclosed
2026-07-01
Vendor
Anysphere
Product
Cursor IDE
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent wrote outside its sandbox and executed at OS level
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection mcp or web search result
Impact type
Remote code execution, Sandbox escape, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
every Cursor version before 3.0
Capability abused
Defense & remediation
Recorded defense
Cursor's command sandbox plus a symlink resolution check for writes outside the project
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Cursor 3.0, released 2026-04-02; symlink fix completed by 2026-06-01 (reported 2026-02-19, initially rejected 2026-02-23, escalated 2026-02-26)
Taxonomy & references
Curator notes
CVE-2026-50548: the sandbox permits writes into a command's working folder, and working_directory is an attacker-steerable parameter on Cursor's run_terminal_cmd tool - pointing it at the cursorsandbox binary or ~/.zshrc. CVE-2026-50549: when the symlink check fails (target missing, or read access removed from a path component) Cursor falls back to trusting the shortcut's in-project path and writes straight through it. No click or approval required; the trigger is an ordinary user request that ingests attacker-controlled content from an MCP server or poisoned web-search result. Cursor's advisory for the symlink bug credits both Cato AI Labs and Wiz (see GhostApproval). No in-the-wild exploitation reported.
Supporting sources
Cite as
Enkrypt AI. "DuneSlide: zero-click prompt injection escapes the Cursor sandbox for OS-level code execution". AIR, AIR-2026-0149. https://agentincident.vercel.app/i/AIR-2026-0149/ (accessed 2026-10-19).