Critical zero-click prompt injection vulnerabilities in Cursor AI code editor allow sandbox escape and remote code execution
By
HackMoN Ai
Summary
Two critical zero-click prompt injection vulnerabilities (CVE-2026-50548 and CVE-2026-50549, collectively "DuneSlide") were discovered in Cursor, an AI-powered code editor used by over half the Fortune 500. These flaws allow attackers to break out of the editor's security sandbox and execute arbitrary commands on a developer's machine without any user interaction—no clicks or approval dialogs required. The vulnerabilities are especially dangerous in AI-assisted development workflows where trust in LLM-generated commands is high, potentially enabling full machine compromise through a single malicious prompt.
Source
bskyCritical zero-click prompt injection vulnerabilities in Cursor AI code editor allow sandbox escape and remote code executionundercodetesting.comKey quotes
· 3 pulledTwo critical vulnerabilities in Cursor, an AI-powered code editor trusted by over half the Fortune 500, could allow a single innocuous-looking prompt to break out of the editor's security sandbox and execute arbitrary commands on a developer's machine.
Tracked as CVE-2026-50548 and CVE-2026-50549 and collectively dubbed 'DuneSlide,' these zero-click prompt injection flaws require no user interaction—no click, no approval dialog.
These vulnerabilities are especially dangerous in modern AI-assisted development workflows where trust in LLM-generated commands is often high.
You might also wanna read
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
Critical RCE Vulnerability in OpenClaw AI Assistant (CVE-2026-25253) Allows Data and Key Theft
A technical security analysis reveals a critical remote code execution (RCE) vulnerability (CVE-2026-25253) in OpenClaw, a popular open-sour
depthfirst.com·5mo ago
AI Coding Agent Security: Prompt Injection Attacks and Vulnerabilities
The article discusses critical security vulnerabilities in AI coding agents, specifically focusing on prompt injection attacks. It details r
openguard.sh·3mo ago
Security Analysis: AI Agent Frameworks' Code Execution Vulnerabilities and WASM Sandbox Solution
The article discusses security vulnerabilities in popular AI agent frameworks like LangChain, AutoGen, and SWE-Agent that execute LLM-genera
github.com·5mo ago
Critical RCE vulnerability CVE-2026-3854 discovered in GitHub's internal git infrastructure
Wiz Research discovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure affecting both GitHub.com and GitHu
Wiz.io·2mo ago
OpenCode AI Coding Agent Hit with Critical Remote Code Execution Vulnerability
OpenCode, a popular open-source AI coding agent, was recently hit with a critical CVE (Common Vulnerabilities and Exposures) that allowed fo
johncodes.com·5mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.