{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-50548",
    "name": "CVE-2026-50548",
    "vendor": "Zero-Click",
    "description": "Cato AI Labs disclosed DuneSlide, two critical flaws (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) that let a single prompt escape Cursor's command sandbox and run arbitrary OS-level code. The trigger is zero-click: an innocuous prompt that ingests an attacker payload from an untrusted source such as an MCP server or web search result, handing over the developer machine and connected cloud/SaaS workspaces.",
    "website": "https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-01",
    "risk": {
      "score": 98,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-50548",
      "aliases": [
        "ti-046"
      ],
      "title": "DuneSlide: Zero-Click RCE Flaws in Cursor AI Code Editor (CVSS 9.8)",
      "summary": "Cato AI Labs disclosed DuneSlide, two critical flaws (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) that let a single prompt escape Cursor's command sandbox and run arbitrary OS-level code. The trigger is zero-click: an innocuous prompt that ingests an attacker payload from an untrusted source such as an MCP server or web search result, handing over the developer machine and connected cloud/SaaS workspaces.",
      "severity": "critical",
      "cvss": {
        "score": 9.8,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection"
      ],
      "componentType": "agent",
      "component": {
        "name": "Zero-Click",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": "all versions before Cursor 3.0 (patched in 3.0)",
          "fixed": "3.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-01",
      "modifiedAt": "2026-07-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50548"
        }
      ],
      "mitigation": "Upgrade Cursor to 3.0 or later and treat MCP outputs and web search results ingested by the agent as untrusted.",
      "detectedByAnomity": true
    }
  }
}