2026-07-01 · 2026-Q3
Cursor "DuneSlide" Zero-Click Prompt-Injection RCE (CVE-2026-50548, CVE-2026-50549)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Cursor AI code editor before 3.0 (fix shipped in Cursor 3.0, released April 2, 2026)
Impact
A single innocuous prompt that ingests attacker-controlled content from an MCP server or web-search result can escape the terminal sandbox and reach OS-level remote code execution with no user interaction, giving full compromise of the host machine and connected SaaS workspaces
Root cause
Two chained flaws let injected instructions overwrite the `cursorsandbox` enforcer binary: CVE-2026-50548 trusts the agent-chosen working directory so a system path grants out-of-scope write permission, and CVE-2026-50549 is a symlink canonicalization check that fails open when path resolution fails. Reported by Cato AI Labs (Itay Ravia) on February 19, 2026; CVEs assigned June 5 and detailed publicly on July 1, 2026
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Cursor "DuneSlide" Zero-Click Prompt-Injection RCE (CVE-2026-50548, CVE-2026-50549) (2026-07-01). https://agentprov.com/incidents/2026-07-01-cursor-duneslide-zero-click-prompt-injection-rce-cve-2026-50548-cve-2026-50549
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run