VulnerabilityPublished 3 Jul 2026

Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution

Source SecurityWeek

Mentioned vulnerabilities

Fixed in 3.0 : patch affected systems as a priority.

Data as of 6 Jul 2026, 00:34 UTC

Severity

Critical

Rated by Threat Radar

Patch: Available – fixed in 3.0

remote

What to do

AI-suggested

Patches addressing both vulnerabilities were released in Cursor version 3.0 on April 2, 2026. Users and organizations should upgrade to Cursor 3.0 or later to remediate these issues. Since the vulnerabilities are patched, no additional immediate mitigation steps are required beyond applying the official update.

Description

The DuneSlide vulnerabilities enable zero-click prompt injection attacks that escape Cursor's sandbox and execute arbitrary code on the underlying operating system. The post Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution appeared first on SecurityWeek .

Impact

Successful exploitation of these vulnerabilities allows an attacker to execute arbitrary code on the underlying operating system with the privileges of the Cursor application. This breaks the sandbox security model, enabling remote code execution (RCE) without user interaction (zero-click). The attacker can overwrite the sandbox executable to run unrestricted commands, potentially leading to full system compromise.

Summary

The DuneSlide vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor AI code editor enable remote code execution outside the IDE sandbox through zero-click prompt injection attacks. The first vulnerability arises from the sandbox's working_directory parameter, which when set to a non-default value, adds an attacker-controlled path to an allow list, permitting overwriting of the cursorsandbox executable and unrestricted command execution. The second vulnerability involves flawed path canonicalization logic that mishandles symbolic links, allowing attackers to bypass out-of-bounds write protections by creating write-only symlinks pointing to the cursorsandbox executable. These flaws exploit Cursor's automatic terminal command execution without user approval. Both issues were responsibly disclosed to Cursor in February 2026 and fixed in Cursor 3.0, released April 2, 2026.

References

securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 3 Jul 2026, 08:06 UTC

References

Community reviews

Related threats