Critical Cursor IDE RCE Vulnerabilities Enable Prompt Injection in Zero

Cybersecuritynews •Guru Baran • July 1, 2026

Two critical remote code execution (RCE) vulnerabilities in Cursor IDE, the AI-powered development environment used by more than half of Fortune 500 companies. Cato AI Labs has disclosed two flaws, dubbed ” DuneSlide, ” both of which carry a 9.8 CVSS severity score and were assigned CVE-2026-50548 and CVE-2026-50549, allowing attackers to break out of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in Cursor IDE Enable Zero-Click Prompt Injection Attacks Cato AI Labs disclosed two critical remote code execution (RCE) vulnerabilities in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549. These vulnerabilities allow attackers to exploit zero-click prompt injection, enabling arbitrary code execution without user interaction. The flaws arise from improper handling of the working directory and symlink resolution within Cursor's sandboxed environment. This attack vector is particularly dangerous as it can be triggered by benign prompts that ingest malicious content from untrusted sources. The vulnerabilities have a CVSS score of 9.8, indicating a critical severity level. Cursor IDE is widely used, with over half of Fortune 500 companies relying on it. A patch was released in April 2026, but systems not updated remain vulnerable. Users are advised to avoid processing untrusted content until a confirmed fix is implemented. 23 sources 73

Extracted Entities

Critical Cursor IDE RCE Vulnerabilities Enable Prompt Injection in Zero

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Vulnerabilities (1)