Thought Leadership
Security researchers have uncovered two critical vulnerabilities in the AI development environment Cursor. By using specially crafted prompts, attackers can escape the application’s sandbox and execute code directly on the host operating system — without requiring any user interaction.
Security firm Cato Networks has disclosed the vulnerabilities under the name DuneSlide. The flaws are tracked as CVE-2026-50548 and CVE-2026-50549 and received a CVSS score of 9.8, the highest possible severity rating. Both vulnerabilities allow attackers to break out of Cursor’s isolated execution environment and run commands directly on the underlying operating system.
Automatic Terminal Commands Create the Risk
The root cause is a Cursor feature that automatically executes terminal commands inside the sandbox without requiring user approval. If malicious content reaches the IDE — for example through an external MCP server—it can manipulate the underlying large language model into performing unintended actions. No user interaction is required, making the attack fully automatable.
First Vulnerability: Escaping the Working Directory
Under normal conditions, command execution is strictly limited to the current project directory. According to Cato, however, this restriction can be bypassed by setting the working directory parameter to an attacker-controlled location. Cursor then adds this value to an internal allowlist without validating it.
An apparently harmless request to an MCP server can secretly instruct the AI model to change its working directory to an attacker-selected location. Once this succeeds, the sandbox’s central configuration file, cursorsandbox, can be overwritten. From that point on, all subsequent commands execute without the sandbox’s intended restrictions.
Second Vulnerability: Exploiting Symbolic Links
The second flaw is unrelated to the first and affects the way Cursor resolves file paths. A specially crafted prompt can persuade the AI agent to create a symbolic link inside the project directory that points to a file outside the allowed workspace.
When Cursor attempts to validate the link, it mishandles path resolution. Instead of resolving the link to its actual destination, the application continues to evaluate the original symbolic link path. As a result, the built-in protection designed to prevent writes outside the project directory is bypassed. This technique also allows attackers to modify the cursorsandbox file.
Patch Available Since April
Cato Networks privately disclosed both vulnerabilities to the Cursor developers in February. The issues were fixed in Cursor version 3.0, released in early April. The official CVE identifiers were assigned later, in early June.
Organizations and developers using Cursor should verify that they are running version 3.0 or later to protect against these attack vectors.
(lb)
