Topic image: source code security stock image for MCPwatch editorial use.
On July 1, 2026, Cato AI Labs disclosed DuneSlide — two critical sandbox-escape vulnerabilities in the Cursor AI code editor that let a poisoned MCP server response or crafted web result execute arbitrary commands on a developer’s machine with zero clicks. Tracked as CVE-2026-50548 and CVE-2026-50549, both carry a CVSS 3.1 score of 9.8 (Critical). The patch shipped in Cursor 3.0 on April 2, 2026, but every earlier version remains vulnerable.
See also: our first-wave MCP incident overview →
What DuneSlide Is
DuneSlide names a pair of chained flaws in Cursor’s terminal sandbox — the security boundary that isolates AI-initiated shell commands from the host system. When chained, they allow an attacker-controlled input to overwrite the sandbox binary itself, after which all subsequent commands run without restriction.
CVE-2026-50548 — working_directory bypass. Cursor’s run_terminal_cmd tool accepts an optional working_directory parameter. The sandbox permits file writes into the command’s working folder, and that folder can be set by the AI agent itself. A malicious MCP server response or web page can cause the agent to point working_directory at the directory containing the sandbox binary, gaining an unrestricted write into it.
CVE-2026-50549 — symlink validation bypass. Before writing a file, Cursor resolves symbolic links to confirm the real destination sits inside the project. If symlink resolution fails, Cursor falls back to checking the original (un-resolved) path — effectively skipping the security check. An attacker can craft a symlink that passes the fallback check while pointing outside the project.
Both flaws end the same way: the sandbox enforcement binary is overwritten, and all subsequent terminal commands execute freely on the developer’s machine.
Why This Matters for MCP Operators
The DuneSlide disclosure is directly relevant to MCPwatch readers for three reasons:
1. MCP servers are the attack vector. Cato’s disclosure confirms that a single poisoned MCP server response is sufficient to trigger the chain. An agent connected to a malicious or compromised MCP server can be directed to execute the payload — no user interaction required. This is not a theoretical MCP risk; it is a confirmed chain where MCP is the entry point for a CVSS 9.8 code-execution vulnerability affecting one of the most widely used AI coding tools.
2. Sandbox boundaries are fragile in AI tooling. Cursor introduced its sandbox specifically to contain AI-initiated commands. DuneSlide shows that even security-motivated sandbox designs accumulate bypass paths when they interact with complex, agent-driven workflows. This pattern — sandbox intended for safety, bypass via agent-controllable parameters — is likely to recur across other AI coding agents that accept MCP tool calls.
3. The patch predates the disclosure, but adoption is unclear. Cursor 3.0 shipped on April 2, 2026, roughly three months before the public disclosure. Organizations that auto-update may already be safe. Those that pinned to 2.x for stability or workflow reasons may still be running a vulnerable version.
Operator Checklist
If your teams use Cursor with MCP servers, take these steps:
1. Confirm Cursor version. Open Cursor → About (or check cursor --version). Versions before 3.0 are vulnerable. Update immediately if pinned to 2.x.
2. Audit connected MCP servers. Review every MCP server your agents connect to. Remove any you did not explicitly vet. DuneSlide demonstrates that a single malicious server response is enough to compromise the host.
3. Review the MCP Server Security Checklist for inventory, authentication, and egress controls that reduce the risk of connecting to a compromised server.
4. Consider network-level egress controls so that even a compromised agent session cannot reach arbitrary external endpoints. See our MCP SSRF Risk: Operator Audit for a practical framework.
5. Check developer workstations for signs of sandbox binary modification. On macOS, the relevant binary is inside Cursor’s application bundle; on Linux, check the installation directory. An unexpected modification date after an agent session warrants investigation.
Technical Summary
Field
Detail
CVEs
CVE-2026-50548, CVE-2026-50549
Name
DuneSlide
CVSS
9.8 (Critical)
CVSS 4.0
9.3
Affected
Cursor IDE versions before 3.0
Fix
Update to Cursor 3.0+
Attack vector
Poisoned MCP server response or web content → agent writes to sandbox binary directory → sandbox binary overwritten → unrestricted code execution
1 thought on “DuneSlide Cursor MCP CVE Chain”