A recent security bug in Cursor's coding agent has sparked concerns and raised questions about the potential risks it poses to developers and their machines. This issue, which allows cloned repositories to execute commands before trust verification, is a critical flaw that could have serious implications.
The bug, discovered by Manifold Security, highlights a vulnerability in Cursor's command-line agent. Essentially, when a developer clones a repository, the agent's isolated worktree feature, designed to keep AI agents away from the developer's working tree, fails to prompt for trust verification. This means that the repository can run any command it chooses, potentially compromising the developer's machine and data.
The Technical Details
The issue lies in the setup step of the worktree feature. When the agent is started with the worktree flag, it creates a fresh checkout and runs a setup command by default. This command reads a tracked configuration file from the repository and passes its contents directly to a shell, without any parsing, allowlisting, or prompts. This means that the command is unconstrained, and can potentially access sensitive information or execute malicious code.
What makes this particularly fascinating is the fact that this vulnerability is not a new discovery. Cursor had previously patched a similar issue in 2025, known as CVE-2025-64109, which involved a repository-supplied file in the same directory auto-starting an attacker's server. However, the worktree feature, introduced five months later, carried the same primitive, leaving the door open for potential exploitation.
Response and Resolution
Manifold Security reported the issue to Cursor on July 20th, and a fix was released three days later. However, the report was subsequently closed as informative, with Cursor stating that exploitation required user interaction and that the report did not demonstrate a bypass of workspace trust. Manifold, on the other hand, argued that cloning repositories is an integral part of the product's function and that the difference between the two findings is merely the location of the command, not its potential impact.
Despite the fix, no advisory was published by Cursor, which is concerning as it limits the awareness of users still running affected versions. Manifold has recommended that developers using the worktree flag update to the latest build or pass the flag that skips worktree setup entirely. However, the sandbox gap, which allows commands to run outside the sandbox even when it's explicitly switched on, remains unaddressed in the current builds.
Broader Implications
This incident raises important questions about the responsibility of software providers in ensuring the security of their products. While Cursor did address the issue promptly, the lack of an advisory and the closure of the report as informative could potentially leave users vulnerable. It also highlights the need for continuous security audits and the importance of learning from past vulnerabilities to prevent their recurrence.
In my opinion, this incident serves as a reminder that security is an ongoing process and that even small details can have significant implications. As developers and users, we must remain vigilant and proactive in addressing potential risks. The security of our digital ecosystem relies on our collective awareness and action.
