Severity: CriticalVulnerabilityPrompt injection
Sandbox Escape via Prompt Injection in Cursor AI Code Editor
Global
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
Two critical flaws in Cursor, an AI-assisted code editor, allow an attacker to craft a malicious prompt that breaks out of the safety sandbox and executes arbitrary commands on the developer's machine without user interaction or approval. The vulnerabilities, collectively named DuneSlide, carry CVSS scores of 9.8 and 9.3, enabling direct compromise of a developer's host system.
What to do
Immediately patch Cursor to the latest version and restrict AI code editor capabilities to isolated, non-privileged execution environments until fixes are verified.
Mapped framework pillars
Sources
CVE references
#prompt injection#sandbox escape#code execution#AI editor#DuneSlide#developer tools