Critical Cursor IDE Flaws Let Attackers Execute Code via Zero

Gbhackers •Divya • July 2, 2026

Two significant remote code execution (RCE) vulnerabilities in the widely used Cursor ID expose developers to zero-click attacks driven by prompt injection. These vulnerabilities, tracked as CVE-2026-50548 and CVE-2026-50549, collectively known as “DuneSlide,” carry a CVSS score of 9.8. They demonstrate how development environments powered by large language models (LLMs) can unintentionally increase the attack […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in Cursor IDE Enable Zero-Click Prompt Injection Attacks Cato AI Labs disclosed two critical remote code execution (RCE) vulnerabilities in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549. These vulnerabilities allow attackers to exploit zero-click prompt injection, enabling arbitrary code execution without user interaction. The flaws arise from improper handling of the working directory and symlink resolution within Cursor's sandboxed environment. This attack vector is particularly dangerous as it can be triggered by benign prompts that ingest malicious content from untrusted sources. The vulnerabilities have a CVSS score of 9.8, indicating a critical severity level. Cursor IDE is widely used, with over half of Fortune 500 companies relying on it. A patch was released in April 2026, but systems not updated remain vulnerable. Users are advised to avoid processing untrusted content until a confirmed fix is implemented. 37 sources 73

Extracted Entities

Critical Cursor IDE Flaws Let Attackers Execute Code via Zero

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)