Your Cursor agent doesn’t need you to click anything. It just needs to read something — an MCP server’s response, a page a web search pulled back — and two design flaws in how Cursor’s terminal sandbox decided what to trust turned that ordinary read into full remote code execution on the developer’s machine. Cato AI Labs calls the pair DuneSlide, and both hit 9.8 on CVSS 3.1.

TL;DR

  • CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8, are two independent architectural flaws in Cursor IDE’s command sandbox, discovered by Cato Networks’ Cato AI Labs and codenamed DuneSlide.
  • Both are zero-click: a prompt-injected instruction hidden in an MCP server response or a web search result the agent reads is enough — no file download, no approval click, no malicious extension.
  • Mechanism 1 abuses the working_directory parameter on Cursor’s terminal tool, which the sandbox trusts blindly, letting an injected instruction redirect writes to the sandbox helper binary itself. Mechanism 2 abuses a symlink-validation fallback that trusts the apparent in-project path instead of refusing when target resolution fails.
  • Cursor initially rejected the report, arguing its threat model didn’t cover MCP server misuse — even from legitimate servers. Both flaws are fixed in Cursor 3.0 (April 2, 2026); everything before it is vulnerable.
  • Cato is explicit that this is not a Cursor-only problem — independent research (IDEsaster, Cymulate’s Codex CLI findings) shows the same “the agent trusts its own sandbox parameters” pattern recurring across multiple AI coding tools.

Why This Matters to You

If you or your team runs an agentic coding assistant with terminal access, MCP connectors, or web search enabled, the thing standing between “the agent read a web page” and “arbitrary code ran on my laptop with my privileges” was, for every Cursor version before 3.0, two logic bugs in a sandbox that trusted its own inputs too much. You don’t need to be targeted specifically — an attacker only needs content your agent will eventually ingest: a poisoned MCP tool response, a compromised or SEO-gamed search result, a GitHub issue the agent summarizes. If you’re not on Cursor, the pattern still applies to you: this is the second independently disclosed instance in eight months of an AI coding agent’s terminal sandbox trusting agent-controlled parameters it shouldn’t, and researchers now say it recurs across the category.

Table of Contents

What DuneSlide Actually Is

Cato AI Labs, the research arm of network security vendor Cato Networks, found DuneSlide — two independent, critical vulnerabilities in Cursor, the AI-first code editor that Anysphere says is used by more than half the Fortune 500. Both are tracked with their own CVE and both landed at 9.8 (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H):

  • CVE-2026-50548 — CWE-22, Improper Limitation of a Pathname to a Restricted Directory (path traversal), via the working_directory parameter on Cursor’s terminal tool.
  • CVE-2026-50549 — CWE-59, Improper Link Resolution Before File Access, via a symlink-canonicalization fallback.

Head of Cato AI Labs Itay Ravia authored the disclosure. Both bugs live in the same place: the logic that decides which filesystem paths an agent-issued shell command is allowed to write to. Get either one wrong, and a sandboxed command stops being sandboxed.

How Prompt Injection Becomes Remote Code Execution

The uncomfortable part of DuneSlide isn’t the individual bugs — path traversal and unsafe symlink handling are old, well-understood vulnerability classes. It’s the delivery mechanism. Neither flaw requires the attacker to compromise your machine, trick you into installing anything, or get you to click a link. It requires only that your agent, acting on an entirely innocuous prompt from you, reads content the attacker controls.

That content can arrive through a connected MCP server — including a standard, legitimate integration like the official Linear.app connector, misused rather than compromised — or through a page returned by a web search the agent performed on your behalf. The agent has no reliable way to distinguish “instructions from my user” from “text that happens to look like instructions, sitting inside data I was asked to read.” Once the injected text reaches the agent’s context, it can steer parameters on tool calls the agent is about to make — including the two parameters DuneSlide is built on.

This is the structural point Cato is making: prompt injection isn’t staying contained to “the LLM says something embarrassing.” It’s reaching into code paths — terminal sandboxing, path validation — that were never designed with an adversarial prompt in mind, because until agentic tools existed, nothing upstream of those code paths could be attacker-controlled.

Mechanism One: The Working Directory Parameter (CVE-2026-50548)

Cursor’s run_terminal_cmd tool — the function the agent calls to execute a shell command on your behalf — accepts an optional working_directory parameter. The sandbox is supposed to confine command execution and file writes to the current project. But when the agent sets working_directory to a non-default path, Cursor adds that path to the sandbox’s allowed-write list without further validation.

An attacker doesn’t need shell access to abuse this — they need the agent to decide, based on injected instructions, to pass an out-of-scope path into that parameter. From there, a write lands wherever the attacker chose, including the sandbox enforcement helper itself (cursorsandbox, at a fixed location such as /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox on macOS) or shell startup files like ~/.zshrc, ~/.zshenv, or entries under ~/Library/LaunchAgents. Overwrite the sandbox helper, and every subsequent command the agent runs executes with no sandbox at all. Overwrite a shell profile or a LaunchAgent, and the payload runs the next time the developer opens a terminal or logs in — turning a one-shot injection into a persistence mechanism.

The second flaw sits in a safety check that, on its face, sounds reasonable: before writing to a path, Cursor resolves any symlinks in that path to confirm the real destination sits inside the project. If it doesn’t, the write should be refused.

The bug is in what happens when that resolution itself fails — for example, because the symlink’s target doesn’t exist yet, or because the attacker has stripped read access from a directory in the path. Instead of refusing the write as a fail-safe, Cursor falls back to trusting the symlink’s apparent, in-project-looking path. A malicious agent action (again, steered by injected content) can plant a symlink inside the workspace that points outside it, deliberately break canonicalization, and have Cursor write to the real, out-of-bounds target anyway — the exact outcome the check existed to prevent.

Both mechanisms converge on the same result Cato describes: a sandboxed command becomes unsandboxed, non-sandboxed remote code execution, on the host, with the developer’s own privileges.

Disclosure Timeline and Patch Status

  • February 19, 2026 — Cato AI Labs reports both issues to Cursor.
  • February 23, 2026 — Cursor initially rejects the reports, on the stated grounds that its threat model didn’t account for MCP server misuse, even when the MCP server involved is a standard, legitimate integration.
  • February 26, 2026 — Cato escalates directly to Cursor’s security team given the severity; the reports are reopened and triaged.
  • April 2, 2026 — Cursor 3.0 ships, fixing both the working-directory issue and the symlink-fallback issue.
  • June 5, 2026 — CVE-2026-50548 and CVE-2026-50549 are formally assigned.
  • July 1, 2026 — Cato AI Labs publishes the DuneSlide research publicly.

Every Cursor release before 3.0 is affected. There is no evidence of in-the-wild exploitation as of publication — this is disclosed as original research, not an active campaign. We could not locate a standalone Anysphere security advisory dedicated to DuneSlide beyond the fix itself landing in the 3.0 changelog and the boilerplate acknowledgment on Cursor’s GitHub security page thanking researchers for responsible disclosure; if a dedicated advisory exists, it wasn’t surfaced by our searches (flagged below as unverified).

Not Just Cursor: A Category-Wide Pattern

The framing question for any team using an AI coding agent is whether this is a Cursor-specific engineering miss or a symptom of how the whole category builds sandboxes. Cato answers this directly in its own writeup: had these been isolated bugs, they’d have attributed them to Cursor specifically — instead, Cato AI Labs states it is “in the process of responsibly disclosing vulnerabilities in all popular coding agents, highlighting that a more systemic approach to protection is required.”

Independent research backs that framing up. In December 2025, researcher Ari Marzouk published “IDEsaster” — over 30 flaws (24 with assigned CVEs) spanning Cursor, Windsurf, Kiro.dev, GitHub Copilot, Zed.dev, Roo Code, JetBrains Junie, and Cline, including prompt-injection chains that abused workspace configuration trust and JSON schema loading to achieve code execution or data exfiltration across multiple of these tools simultaneously. Marzouk’s own conclusion reads almost like a preview of DuneSlide: “All AI IDEs (and coding assistants that integrate with them) effectively ignore the base software (IDE) in their threat model.” Separately, Cymulate Research Labs documented a comparable zero-click chain in OpenAI’s Codex CLI on Windows, where prompt injection through a web search feature planted a malicious binary that Codex’s own executable-resolution order then ran outside its sandbox — a report OpenAI closed as “not reproducible” despite independent reproduction, leaving it unpatched at time of writing.

The common thread across all of these is architectural, not implementation-specific: these tools built sandboxes to contain what a human might accidentally do, then handed the keys to those sandboxes — working directories, path validation, config files — to an agent that a remote, untrusted party can now partially steer. That’s a design assumption that needs revisiting industry-wide, not a bug tracker item for one vendor.

MITRE ATT&CK Mapping

ATT&CK has no native “prompt injection” technique, so the two Initial Access rows below are our closest analytical fit rather than a mapping Cato or MITRE stated explicitly — everything else in the table reflects the disclosed technical mechanism directly.

TacticTechniqueID
Initial AccessTrusted Relationship (legitimate MCP connector misused as the injection vector)T1199
Initial AccessDrive-by Compromise (poisoned web search result read by the agent)T1189
ExecutionCommand and Scripting InterpreterT1059
Privilege EscalationEscape to Host (sandbox-to-host breakout)T1611
Impair DefensesDisable or Modify Tools (overwriting the cursorsandbox enforcement binary)T1562.001
StealthMasquerading (symlink presenting an in-project path while resolving elsewhere)T1036
PersistenceBoot or Logon Autostart Execution (writes to shell profiles / LaunchAgents)T1547

What You Can Do Today

  1. Update Cursor to 3.0 or later immediately. Every version before it carries both flaws at CVSS 9.8; this is a same-day patch, not a next-sprint one.
  2. Audit what your agent’s MCP servers can actually return. Any MCP integration — including trusted, official ones — is a channel for attacker-controlled text to reach your agent’s context. Prefer MCP servers you can inspect, and treat their responses as untrusted input, not internal data.
  3. Disable or scope down agent web search where you can. If your workflow doesn’t need the agent pulling live web content, turning it off removes an entire injection vector; if it does, understand that any page in the result set is a potential payload source.
  4. Don’t run AI coding agents as a privileged user, and don’t grant terminal auto-approval broadly. Sandbox escapes matter less if the account they land in has narrow permissions; review whatever auto-approve / “yolo mode” settings your tool exposes for shell commands.
  5. Treat this as a pattern, not a one-off. If your team standardized on Windsurf, Copilot, Kiro, Codex CLI, or another agentic IDE instead of Cursor, don’t read “not on Cursor” as “not affected” — IDEsaster and the Codex CLI findings show the same class of trust assumption recurring. Check each tool’s own advisories, not just this one.
  6. Isolate agentic coding sessions in a VM or disposable container where feasible, especially for repos that pull in third-party MCP servers or untrusted dependencies. A sandbox escape that lands in a throwaway environment is a non-event.
  7. Keep an internal registry of which AI coding tools are in use and their patch versions. DuneSlide’s own timeline — reported in February, patched in April, CVEs assigned in June — shows a multi-month gap between “fix exists” and “the world knows to check for it.” Don’t wait for the CVE to know you need to update.

Sources