Researchers Disclose Zero-Click RCE Flaws In Cursor IDE | Let's Data Science

The disclosure is a reminder that AI coding agents' expanded permissions - reading files, running shell commands and fetching external content on a developer's behalf - create an attack surface that traditional sandboxing wasn't designed for, and that zero-click compromise is now achievable through content an agent merely reads. Cato Networks' AI Labs disclosed two critical vulnerabilities, dubbed DuneSlide (CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10 under CVSS 3.1), in the Cursor AI code editor that could let a single prompt-injected instruction escape the editor's sandbox and execute arbitrary commands on a developer's machine, without any click or approval from the user. Both flaws were patched in Cursor 3.0, released April 2, meaning every version before that release remains vulnerable if not updated. The bugs abuse how Cursor's sandbox handles a configurable working-directory parameter and how it resolves symlinks before writing files, letting attacker-controlled content delivered via MCP connections or web results redirect and disable the sandbox helper itself.

Cato Networks' AI Labs disclosed DuneSlide, a pair of critical remote-code-execution vulnerabilities in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 and rated 9.8 out of 10 under CVSS 3.1 (9.3 under CVSS 4.0), according to The Hacker News and CybersecurityNews.

Both flaws enable zero-click prompt injection: an attacker never types into the victim's Cursor session directly. Instead, malicious instructions are planted inside content the AI agent reads on the user's behalf, such as a document fetched through a Model Context Protocol connector or a page returned by a web . CVE-2026-50548 abuses the working_directory parameter on Cursor's run_terminal_cmd tool: when an agent sets that path to a non-default location, Cursor adds it to an allowed-write list without further verification, letting injected instructions redirect writes to overwrite the sandbox's own helper binary and disable sandboxing entirely for later commands. CVE-2026-50549 abuses a fallback in Cursor's symlink-resolution safety check: when that check cannot confirm a write target sits inside the project, because the target does not exist or read access has been stripped, Cursor defaults to trusting the symlink's claimed in-project path instead of blocking the write.

AI coding agents are increasingly granted broad, semi-autonomous permissions to read files, call tools and execute shell commands, and this case shows that sandbox logic designed around human-triggered actions does not necessarily hold up against content an autonomous agent ingests on its own. Any feature that lets an agent fetch external content - MCP servers, web , connected repos - becomes a potential injection vector, and organizations building on agentic coding tools should audit similar working-directory and symlink-handling logic in their own stacks, not just Cursor's.

Both vulnerabilities are already patched in Cursor 3.0, released April 2, 2026; every version prior to 3.0 remains exposed. Cursor users should confirm they are running 3.0 or later.

A CVSS 9.8 zero-click RCE chain in a widely used AI coding editor illustrates a systemic weakness in how agentic dev tools sandbox autonomous file and shell access; already patched, but a reference case for practitioners hardening similar coding-agent architectures.

Public references used for this report.

Practice interview problems based on real data

1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.