DuneSlide (CVE-2026-50548) is a critical CVSS 9.3 flaw that lets a crafted, zero-click prompt escape the Cursor AI editor's sandbox and run OS commands on a developer's machine. It is fixed in Cursor 3.0, update now. It is not in CISA KEV, but the delivery path is prompt injection inside untrusted repositories, so treat any pre-3.0 session on untrusted code as exposed.

The pitch for AI code editors like Cursor is that they read everything for you, your repository, your open issues, the web page you pasted in, and act on it. Last week, researchers at Cato AI Labs showed what happens when that reading becomes the attack.

The two flaws they found, reported by The Hacker News and named DuneSlide, let a single ordinary-looking prompt escape Cursor's safety sandbox and run commands directly on the developer's machine. There is no link to click and no permission box to approve. The malicious instruction simply rides inside content the AI was asked to process, and the AI does the rest. Cato tracked the pair as CVE-2026-50548 and a companion flaw, and Cursor has since shipped a fix.

What makes this more than one vendor's bug is the category it belongs to. Prompt injection is usually discussed as a content-moderation nuisance, a way to make a chatbot say something it should not. Here it is remote code execution. As AI assistants gain permission to read and run things inside developer environments, the blast radius of a single crafted prompt grows to match, and the tools writing your code quietly become part of your threat model.

Update Cursor now if you use it, and until you are sure, treat any session on an untrusted repository as a privileged one. The longer lesson is that AI tooling has to be tested as adversarially as any other software that can execute code, including the prompt-injection paths no traditional scanner thinks to look for.

Sources: The Hacker News and SecurityWeek, with the flaws discovered by Cato AI Labs.

Affected versions and fix

• Affected: Cursor before 3.0. The agent sandbox granted write access to the command working directory, and the agent could modify the working_directory parameter to escape it (CWE-22 path traversal).

• Severity: CVSS 9.3 (Critical), no user interaction beyond opening the content; discovered by Cato AI Labs.

• Fix: update to Cursor 3.0 or later.

DuneSlide is one instance of a broader class; see our roundup of AI coding-agent sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity.

Frequently asked questions

What is DuneSlide (CVE-2026-50548)?

DuneSlide is a sandbox-escape flaw in the Cursor AI code editor. A crafted, ordinary-looking prompt can make the agent run OS commands outside its sandbox, turning the AI toolchain itself into the attack surface.

Which Cursor versions are affected, and is it fixed?

Cursor before 3.0 is affected; the flaw is fixed in Cursor 3.0. Update immediately if you use Cursor.

How does the DuneSlide sandbox escape work?

Cursor ran agent terminal commands in a sandbox that had write access to the working directory. The agent could be steered into modifying the working_directory parameter so a sandboxed command wrote and executed outside the sandbox, a path-traversal escape (CWE-22).

Am I at risk if I only open untrusted repositories?

Yes. Until you are on Cursor 3.0, treat any session on an untrusted repository as privileged, prompt-injection inside a repo is the delivery path, and it needs no extra clicks.

Who discovered DuneSlide?

The flaws were discovered by Cato AI Labs.