Critical Cursor IDE Flaws Let Attackers Execute Code via Zero-Click Prompt Injection

Two significant remote code execution (RCE) vulnerabilities in the widely used Cursor ID expose developers to zero-click attacks driven by prompt injection.

These vulnerabilities, tracked as CVE-2026-50548 and CVE-2026-50549, collectively known as “DuneSlide,” carry a CVSS score of 9.8. They demonstrate how development environments powered by large language models (LLMs) can unintentionally increase the attack surface beyond traditional limits.

Cursor has reportedly been adopted by over half of Fortune 500 companies. It is now at the center of growing risks associated with AI-assisted development.

Zero-Click Prompt Injection

These vulnerabilities exploit architectural weaknesses in Cursor’s sandboxed command-execution model, which was designed to run terminal commands without user approval to minimize friction.

While sandboxing aims to contain potentially harmful operations, both flaws allow attackers to bypass these restrictions and execute arbitrary code on the host system.

Importantly, exploitation requires no direct user interaction, just a benign prompt that processes attacker-controlled content from sources such as malicious MCP servers or compromised web results.

The first vulnerability involves manipulation of the working directory parameter used during sandbox policy construction. Cursor allows write access to the current working directory when executing commands.

However, it fails to validate this parameter when the LLM dynamically sets it. Through prompt injection, an attacker can trick the system into assigning a working directory outside the intended project scope.

This enables arbitrary file writes to sensitive locations, including the Cursor sandbox binary. By overwriting this binary, attackers can effectively turn off sandbox protections, allowing subsequent commands in the same execution chain to run unrestricted, resulting in a complete system compromise.

Symlink Exploit Leads to Full System Compromise

The second flaw originates from improper handling of symbolic link (symlink) resolution. Cursor attempts to canonicalize file paths to ensure they remain within project boundaries.

However, if canonicalization fails, such as when encountering inaccessible or non-existent paths, the system falls back on trusting the original symlink path.

Attackers can exploit this behavior by creating write-only symbolic links pointing to critical files outside the project directory. By using the IDE’s file-writing capabilities, they can overwrite protected binaries such as the sandbox helper, leading to sandbox escape and arbitrary code execution.

Both vulnerabilities highlight a critical shift in threat models. Prompt injection serves as a bridge between untrusted external data and sensitive internal execution paths.

Unlike traditional exploits, these attacks leverage the LLM’s decision-making to manipulate system-level behavior, effectively turning the development assistant into an attack vector.

Cato AI Labs reported the issues in February 2026, but their initial findings were rejected. After escalating the matter, the vulnerabilities were ultimately acknowledged.

Fixes for both vulnerabilities were rolled out in Cursor version 3.0, released in April and June 2026. The assignment of CVE identifiers in June confirms their severity and industry impact.

DuneSlide underscores the urgent need for robust validation, strict sandbox enforcement, and updated threat models in AI-powered development tools, as attackers increasingly exploit the intersection of LLM logic and system-level execution.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN