> TritonInfoSec News
Home / Jul 02, 2026 / Story
0
#8 The Hacker News general July 01, 2026 at 14:42 UTC

Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands

By [email protected] (The Hacker News)

AI Summary

Cato AI Labs discovered two critical flaws in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 (both rated 9.8 CVSS), collectively named DuneSlide, which allow a malicious prompt injection to break out of the editor's sandbox and execute arbitrary commands on a developer's machine with no user interaction. The vulnerabilities are particularly dangerous for developer workstations handling sensitive code and secrets.

Read full article → https://thehackernews.com/2026/07/critical-cursor-…

Relevance score: 81.0/100

# More from July 02

  1. 1
    DHS confirms hackers breached HSIN info-sharing platform BleepingComputer
  2. 2
    FortiBleed credential-theft campaign linked to Lynx ransomware BleepingComputer
  3. 3
    Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic The Hacker News
  4. 4
    Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts The Hacker News
  5. 5
    Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack SecurityWeek
  6. 6
    Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts The Hacker News
  7. 7
    19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges The Hacker News
  8. 9
    Over 900 Oracle E-Business instances exposed to ongoing attacks BleepingComputer
  9. 10
    New ChocoPoC malware targets researchers via trojanized PoC exploits BleepingComputer