03 radar.offseq.com Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide

DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.

DuneSlide comprises two critical RCE vulnerabilities in Cursor IDE that exploit zero-click prompt injection. The AI agent within the IDE can be manipulated by attacker-controlled content ingested from untrusted sources like MCP servers or web results. This leads to sandbox escape, arbitrary file writes, and unsandboxed remote code execution. The attack vector is notable because it requires no user action beyond the agent processing a seemingly normal prompt. This demonstrates that sandbox protections alone are insufficient without strict input validation and permission controls. The vulnerabilities are identified as CVE-2026-50548 and CVE-2026-50549.

Successful exploitation allows an attacker to remotely execute arbitrary code on the victim's system without any user interaction, bypass sandbox restrictions, and write arbitrary files. This can lead to full system compromise of the environment running Cursor IDE.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted content through Cursor IDE's AI agent and monitor vendor communications for updates. No official patch or workaround information is currently provided.

DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.

Cato AI Labs just disclosed DuneSlide, two critical RCE vulnerabilities found in Cursor IDE: CVE-2026-50548 and CVE-2026-50549. Both are rated Critical.

The interesting part is the attack path. This was not just prompt injection changing model output. The agent could ingest untrusted content from sources like MCP servers or web results, then act through the app around it.

With DuneSlide, zero-click prompt injection could become a path to:

A user does not need to open a malicious file or run attacker-controlled code. The exploit can start when a normal-looking prompt causes the agent to ingest attacker-controlled content from an untrusted source.

The main thing this research shows is the sandbox matters, but so do the inputs, permissions, execution paths, and boundaries around it.

Full writeup:

Machine-generated threat intelligence

DuneSlide comprises two critical RCE vulnerabilities in Cursor IDE that exploit zero-click prompt injection. The AI agent within the IDE can be manipulated by attacker-controlled content ingested from untrusted sources like MCP servers or web results. This leads to sandbox escape, arbitrary file writes, and unsandboxed remote code execution. The attack vector is notable because it requires no user action beyond the agent processing a seemingly normal prompt. This demonstrates that sandbox protections alone are insufficient without strict input validation and permission controls. The vulnerabilities are identified as CVE-2026-50548 and CVE-2026-50549.

Successful exploitation allows an attacker to remotely execute arbitrary code on the victim's system without any user interaction, bypass sandbox restrictions, and write arbitrary files. This can lead to full system compromise of the environment running Cursor IDE.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted content through Cursor IDE's AI agent and monitor vendor communications for updates. No official patch or workaround information is currently provided.

Threat ID: 6a454c8d27e9c79719db84fc

Added to database: 07/01/2026, 17:21:17 UTC

Last enriched: 07/01/2026, 17:21:22 UTC

Last updated: 07/01/2026, 22:25:51 UTC

Crowdsource mitigation strategies, intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Instant breach scanning across billions of leaked records. Free tier available.