Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide
Source Reddit NetSec
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 1 Jul 2026, 17:21 UTC
What to do
AI-suggested
Until an official fix is available, users should avoid processing untrusted content through Cursor IDE's AI agent and monitor vendor communications for updates.
Discussion
DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.
r/netsec (opens in a new tab)u/bscottrosen210 points0 comments
Cato AI Labs just disclosed DuneSlide, two critical RCE vulnerabilities found in Cursor IDE: CVE-2026-50548 and CVE-2026-50549. Both are rated Critical.
The interesting part is the attack path. This was not just prompt injection changing model output. The agent could ingest untrusted content from sources like MCP servers or web search results, then act through the app around it.
With DuneSlide, zero-click prompt injection could become a path to:
- sandbox escape
- arbitrary file write
- unsandboxed remote code execution
A user does not need to open a malicious file or run attacker-controlled code. The exploit can start when a normal-looking prompt causes the agent to ingest attacker-controlled content from an untrusted source.
The main thing this research shows is the sandbox matters, but so do the inputs, permissions, execution paths, and boundaries around it.
Full writeup: https://bit.ly/4vMylp8