Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide
DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.
AI Analysis
Technical Summary
DuneSlide comprises two critical RCE vulnerabilities in Cursor IDE that exploit zero-click prompt injection. The AI agent within the IDE can be manipulated by attacker-controlled content ingested from untrusted sources like MCP servers or web search results. This leads to sandbox escape, arbitrary file writes, and unsandboxed remote code execution. The attack vector is notable because it requires no user action beyond the agent processing a seemingly normal prompt. This demonstrates that sandbox protections alone are insufficient without strict input validation and permission controls. The vulnerabilities are identified as CVE-2026-50548 and CVE-2026-50549.
Potential Impact
Successful exploitation allows an attacker to remotely execute arbitrary code on the victim's system without any user interaction, bypass sandbox restrictions, and write arbitrary files. This can lead to full system compromise of the environment running Cursor IDE.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted content through Cursor IDE's AI agent and monitor vendor communications for updates. No official patch or workaround information is currently provided.
Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide
Description
DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.
Reddit Discussion
Cato AI Labs just disclosed DuneSlide, two critical RCE vulnerabilities found in Cursor IDE: CVE-2026-50548 and CVE-2026-50549. Both are rated Critical.
The interesting part is the attack path. This was not just prompt injection changing model output. The agent could ingest untrusted content from sources like MCP servers or web search results, then act through the app around it.
With DuneSlide, zero-click prompt injection could become a path to:
- sandbox escape
- arbitrary file write
- unsandboxed remote code execution
A user does not need to open a malicious file or run attacker-controlled code. The exploit can start when a normal-looking prompt causes the agent to ingest attacker-controlled content from an untrusted source.
The main thing this research shows is the sandbox matters, but so do the inputs, permissions, execution paths, and boundaries around it.
Full writeup: https://bit.ly/4vMylp8
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DuneSlide comprises two critical RCE vulnerabilities in Cursor IDE that exploit zero-click prompt injection. The AI agent within the IDE can be manipulated by attacker-controlled content ingested from untrusted sources like MCP servers or web search results. This leads to sandbox escape, arbitrary file writes, and unsandboxed remote code execution. The attack vector is notable because it requires no user action beyond the agent processing a seemingly normal prompt. This demonstrates that sandbox protections alone are insufficient without strict input validation and permission controls. The vulnerabilities are identified as CVE-2026-50548 and CVE-2026-50549.
Potential Impact
Successful exploitation allows an attacker to remotely execute arbitrary code on the victim's system without any user interaction, bypass sandbox restrictions, and write arbitrary files. This can lead to full system compromise of the environment running Cursor IDE.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted content through Cursor IDE's AI agent and monitor vendor communications for updates. No official patch or workaround information is currently provided.
Technical Details
- Source Type
- Subreddit
- netsec
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":38,"reasons":["external_link","newsworthy_keywords:rce","established_author","recent_news"],"isNewsworthy":true,"foundNewsworthy":["rce"],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a454c8d27e9c79719db84fc
Added to database: 07/01/2026, 17:21:17 UTC
Last enriched: 07/01/2026, 17:21:22 UTC
Last updated: 07/02/2026, 01:51:22 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.