Cursor’s Command-Line Coding Agent Vulnerability Raises Security Concerns
A newly identified flaw in Cursor’s command-line coding agent has emerged as a significant security issue, enabling cloned repositories to execute commands on developers’ machines without prior consent. This vulnerability exists even when a security feature, known as the "sandbox," is activated.
Manifold Security, the firm that discovered the flaw, reported its findings to Cursor on July 20. They subsequently published their detailed analysis on August 10. Cursor acted quickly to address the vulnerability, implementing a fix just three days after the issue was reported. However, the company classified the submission as "informative," indicating that it did not perceive the problem as a security threat. Consequently, no formal advisory was released to alert users.
Francisco Rosales, an offensive security engineer at Manifold, was instrumental in uncovering the specific weakness within the agent’s isolated worktree feature. This designed element aims to segregate the AI agent’s activities from a developer’s active working environment, thereby maintaining an extra layer of security. However, the discovered flaw undermines this very purpose.
Unrestricted Command Execution Raises Alarm
The situation began when the command-line agent was initiated with the "worktree" flag, which establishes a new checkout devoid of any build outputs. During this initial process, a setup step is automatically executed, which reads a cached configuration file from the repository and sends its contents directly to a shell. Alarmingly, this action occurs without any prior parsing, allowlisting, or prompting for user consent.
The configuration file, which typically comes alongside a standard clone, appears entirely mundane upon delivery. Manifold highlighted the unrestricted nature of the commands that could be executed, such as reading Secure Shell (SSH) keys, extracting cloud credentials from the environment, establishing a reverse shell, or writing persistent scripts.
The setup step operates under a policy that Cursor has internally labeled as one that voids the sandbox feature; this policy is hardcoded along the designated path. Importantly, enabling the sandbox via a command line flag did not alter this hardcoded setting, thus undermining its protective utility.
Cursor had previously addressed a related issue in 2025 when a repository-provided file capable of launching an attacker’s server on opening was recorded as CVE-2025-64109, rated a substantial risk at 8.8. The worktree feature was introduced five months after this fix, yet it still carried the same problematic code.
Rapid Response But No Advisory Issued
Manifold reported the vulnerability through HackerOne, accompanied by a proof-of-concept (PoC) repository and a screen recording demonstrating the exploit. A remedial build was released on July 23, repositioning the setup command to occur after a trust prompt, thereby increasing security.
Nevertheless, just six days later, Cursor closed the report as informative. Manifold noted that Cursor justified this decision by arguing that exploitation would necessitate the user to clone or open a repository controlled by an attacker. Additionally, they claimed the report did not clearly demonstrate a bypass of the workspace trust mechanism.
In response, Manifold asserted that cloning repositories is fundamental to the product’s intended functionality, echoing sentiments shared during the disclosure of CVE-2025-64109. They argued that the differences between the two vulnerabilities lied only in the specific file that carried the malicious command, not in the potential threat posed by such commands.
Importantly, no advisory was released alongside the fix, and the updated build was not listed in Cursor’s changelog for July. Manifold emphasized that Cursor has issued advisories for similar vulnerabilities in the past, noting that such advisories are crucial for informing users operating outdated or vulnerable versions of the software.
For developers utilizing the worktree flag, it is crucial to update to build 2026.07.23-e383d2b or a later version to effectively close the pre-trust vulnerability. Alternatively, passing the documented flag to bypass worktree setup entirely may be another option. However, it is noteworthy that the existing sandbox gap remains unresolved in current builds.
Infosecurity Magazine has reached out to Cursor to obtain comments regarding the closure of the report and the absence of a formal advisory. Updates will be provided as more information becomes available.
This incident serves as a reminder of the continual need for vigilance in software security and the importance of transparent communication between companies and users regarding vulnerabilities and risks.