The DuneSlide vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor AI code editor enable remote code execution outside the IDE sandbox through zero-click prompt injection attacks. The first vulnerability arises from the sandbox's working_directory parameter, which when set to a non-default value, adds an attacker-controlled path to an allow list, permitting overwriting of the cursorsandbox executable and unrestricted command execution. The second vulnerability involves flawed path canonicalization logic that mishandles symbolic links, allowing attackers to bypass out-of-bounds write protections by creating write-only symlinks pointing to the cursorsandbox executable. These flaws exploit Cursor's automatic terminal command execution without user approval. Both issues were responsibly disclosed to Cursor in February 2026 and fixed in Cursor 3.0, released April 2, 2026.

Successful exploitation of these vulnerabilities allows an attacker to execute arbitrary code on the underlying operating system with the privileges of the Cursor application. This breaks the sandbox security model, enabling remote code execution (RCE) without user interaction (zero-click). The attacker can overwrite the sandbox executable to run unrestricted commands, potentially leading to full system compromise.

Patches addressing both vulnerabilities were released in Cursor version 3.0 on April 2, 2026. Users and organizations should upgrade to Cursor 3.0 or later to remediate these issues. Since the vulnerabilities are patched, no additional immediate mitigation steps are required beyond applying the official update.