Case cursor-duneslide-sandbox-escapeAgent hijackIsrael
DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE
Cato Networks found a non-default working_directory was added to Cursor's allow list and unresolved symlinks fell back to their own path, letting injected prompts overwrite the sandbox binary and run any command.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 2, 2026
- Location
- Israel
- Target
- Cursor AI code editor (2.x)
- Severity
- Critical
- Triggered by
- Cato Networks (Cato CTRL)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2026-50548, CVE-2026-50549
What happened
Cato Networks found a non-default working_directory was added to Cursor's allow list and unresolved symlinks fell back to their own path, letting injected prompts overwrite the sandbox binary and run any command.
Impact: Full code execution on developer machines running Cursor 2.x; no exploitation reported
Who triggered it
Actor: Cato Networks (Cato CTRL)
Attribution: Responsible disclosure in February 2026; CVEs assigned June 2026
Motive: Security research
How it happened
Attack vector: Zero-click indirect prompt injection via MCP responses or poisoned search results steering run_terminal_cmd parameters and symlink creation
Root cause: Sandbox allow-list expanded by agent-controlled parameters and weak symlink canonicalisation
Timeline
- Cato reports both flaws to Cursor
- Cursor 3.0 released with fixes
- Public disclosure of CVE-2026-50548 and CVE-2026-50549
Response
Cursor patched in 3.0 and urged 2.x users to upgrade
Current status: Patched
Sources (open in a new tab)
- SecurityWeek securityweek.com
- The Hacker News thehackernews.com
- CSO Online csoonline.com
Cite this case
DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE. AI Threat Watch, case cursor-duneslide-sandbox-escape, Jul 2, 2026. https://aithreat.io/cases/cursor-duneslide-sandbox-escape/
Permanent link: https://aithreat.io/cases/cursor-duneslide-sandbox-escape/