Critical Cursor IDE RCE Vulnerabilities Enable Prompt Injection in Zero-Click

Two critical RCE vulnerabilities (DuneSlide — CVE-2026-50548 and CVE-2026-50549) in Cursor IDE allow prompt-injection attacks to escape the Cursor 2.x sandbox and overwrite the cursorsandbox helper or other sensitive files, resulting in unsandboxed remote code execution; both are CVSS 9.8, require no privileges or user interaction, and can be triggered by poisoned inputs (e.g., MCP server responses or search results), potentially impacting many enterprise users.