Cursor IDE DuneSlide Flaws Enable Zero-Click Sandbox Escape and RCE

Researchers disclosed two critical vulnerabilities in the Cursor AI code editor, collectively named DuneSlide and tracked as CVE-2026-50548 and CVE-2026-50549, that allow zero-click prompt-injection attacks to escape the IDE sandbox and achieve remote code execution on the underlying operating system. Both flaws carry a CVSS 9.8 rating and affect Cursor versions prior to 3.0, with exploitation enabling arbitrary file writes on a victim’s local system and potential compromise of linked SaaS workspaces.

The attack chain abuses Cursor’s agent terminal command handling through working-directory manipulation and a symlink-based path resolution bypass, allowing attackers to overwrite the cursorsandbox helper and run arbitrary commands with the user’s privileges outside the sandbox. The issues were responsibly disclosed in February 2026 and fixed in Cursor 3.0, released on April 2, 2026; while no active exploitation had been confirmed at publication, reporting warned the technique is highly automatable and organizations were urged to upgrade immediately and review any untrusted prompts or files processed before patching.