Particle.news
Download on the App Store
3 ARTICLES
·
last mo.

Cursor Patches DuneSlide Flaws That Let Prompts Break Its Sandbox

Researchers warn the zero-click prompt-injection pattern can still let an agent run arbitrary commands unless tooling separates proposed changes from an external apply step.

Image
Image

Overview

  • Security researchers at Cato AI Labs disclosed two critical sandbox-escape bugs called DuneSlide tracked as CVE-2026-50548 and CVE-2026-50549 that let a prompt-injected instruction cause the agent to write files that disable the sandbox and run commands.
  • Both flaws were fixed in Cursor 3.0, which Cursor shipped on April 2, 2026, and every release prior to 3.0 remains vulnerable.
  • CVE-2026-50548 abuses the run_terminal_cmd working_directory parameter so the editor adds a non-default path to its allowed-write list and can overwrite the sandbox helper or shell startup files, while CVE-2026-50549 forces a symlink safety check to fail and writes outside the project.
  • There is no public evidence of active exploitation so far, but the bugs enable zero-click remote code execution that can expose SSH keys, cloud credentials, build pipelines, and other sensitive files on developer machines.
  • Immediate defenses are to update to Cursor 3.0+, restrict or disable untrusted MCP servers, never run Cursor with elevated privileges, and harden startup files, and longer-term fixes require architecture changes that separate agent proposals from an external apply pipeline and isolate secrets from the agent.