# DuneSlide: Cursor's Sandbox Escapes Turn Poisoned Prompts Into Machine Takeover
## The Threat
Cursor, the AI-powered code editor used by more than half of Fortune 500 companies, contains two critical vulnerabilities that allow attackers to completely escape its security sandbox and execute arbitrary commands on a developer's machine. Identified as DuneSlide by Cato AI Labs, these flaws (CVE-2026-50548 and CVE-2026-50549) require no user interaction beyond asking a seemingly innocent question—making them a perfect delivery vehicle for prompt injection attacks.
The attack works through a zero-click vector: an attacker embeds malicious instructions inside content that Cursor's AI agent naturally reads on behalf of the developer. This content could be a document returned from the Model Context Protocol (MCP)—a standard integration layer for connecting Cursor to services like Linear, GitHub, or Slack—or a webpage scraped during a web search. The developer asks a normal question, the hidden instructions trigger automatically, and the sandbox crumbles.
What makes this particularly dangerous is the scope of compromise. Once the sandbox is disabled, the attacker gains full control not just of the local machine but also any cloud and SaaS workspaces the developer is authenticated to. For security teams managing enterprise fleets of developers, this turns a single prompt injection into a potential beachhead for lateral movement, credential theft, and supply chain attacks.
## Severity and Impact
| Field | Details |
|-------|---------|
| CVE Identifiers | CVE-2026-50548, CVE-2026-50549 |
| CVSS v3.1 Score | 9.8 (Critical) |
| CVSS v4.0 Score | 9.3 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None (Zero-Click) |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CWE | CWE-94 (Code Injection), CWE-22 (Path Traversal) |
Both vulnerabilities earned a critical 9.8 CVSS score (or 9.3 under CVSS 4.0), reflecting the complete loss of sandbox containment and full code execution capability. The zero-interaction requirement makes these among the most dangerous classes of vulnerability.
## Affected Products
Cursor (AI Code Editor)
Development Context
## How the Escapes Work
Both vulnerabilities share the same objective—write a file that disables the sandbox—but achieve it through different mechanisms:
CVE-2026-50548 (Parameter Abuse): Cursor's sandbox permits writes to a command's working directory, controlled by an optional working_directory parameter on the run_terminal_cmd tool. The vulnerability: when an agent sets this parameter to a path outside the project, Cursor adds it to the allowed-write list without validation. An attacker instructs the agent to set the working directory to /Applications/Cursor.app/Contents/Resources/app/resources/helpers/ (macOS) and write a malicious sandbox helper, or target startup files like ~/.zshrc. Subsequent commands run unrestricted.
CVE-2026-50549 (Symlink Check Bypass): Cursor attempts to prevent sandbox escape by resolving symlinks before write operations, confirming the real target lies inside the project. The bug is in the fallback: if the symlink cannot be resolved (because the target doesn't exist or read permissions are denied on a folder in the path), Cursor abandons the check and trusts the symlink's in-project path instead. An attacker creates a symlink pointing outside the project, forces the resolution to fail, and writes directly to the same sandbox helper file.
Either way, once the sandbox helper is overwritten, the next command executes with full user privileges.
## Mitigations
For Cursor Users (Immediate Action Required):
For Security Teams:
For Developers:
## References
## HackWire Analysis
DuneSlide represents a troubling pattern in AI agent security: each new sandbox escape defeats a different guardrail, suggesting defenders are playing whack-a-mole while attackers think in layers. This is the third major Cursor vulnerability in under a year—CurXecute (CVE-2025-54135) arrived just eight months ago, also exploiting prompt injection to break containment.
The real concern isn't Cursor's engineering team; they've been responsive, shipping fixes within weeks of disclosure. The concern is the *threat model itself*. By integrating AI agents with terminal execution and MCP connections, Cursor created a security boundary that doesn't match the attack surface. An MCP integration is meant to be trusted, but the advisory explicitly shows that Cursor rejected the initial reports partly because the threat model "did not cover misuse of MCP servers." That's backwards. In zero-click prompt injection, every integration is a potential injection vector, and every injection vector is a potential sandbox escape.
For enterprises, the implication is stark: AI code editors are now as dangerous as they are productive. The zero-interaction requirement means you can't tell developers to "just don't run prompts from untrusted sources"—the sources are often legitimate services (Linear, GitHub, web search) that have been compromised or are simply displaying attacker-controlled content. A developer linking a Cursor agent to a Linear workspace is trusting that Linear won't be exploited or poisoned.
If you're running Cursor in 2026, treat the update to 3.0 as security-critical, not cosmetic. If you're deploying Cursor in CI/CD or automation, isolate it until you're fully patched. And if you're building enterprise AI agents, learn from DuneSlide: sandbox design is only as strong as its most overlooked escape hatch.
— HackWire Editorial
## Related Coverage