Cursor Security Bug: A Deep Dive into the Pre-Trust Execution Flaw
The recent discovery of a critical security bug in Cursor's command-line coding agent has raised concerns among developers and security researchers alike. This vulnerability, reported by Manifold Security, highlights a significant issue with the agent's isolated worktree feature, which can lead to unauthorized command execution on a developer's machine.
The Vulnerability Unveiled
The core problem lies in the agent's default behavior when the worktree flag is used. When this flag is set, the agent creates a fresh checkout without any build output, triggering a setup step that reads a tracked configuration file from the repository. This file, without any parsing or filtering, is directly passed to a shell, granting unrestricted access to various commands.
Manifold Security's Francisco Rosales identified this issue, noting that the command had no constraints, allowing access to sensitive information like SSH keys, cloud credentials, and even opening reverse shells or writing persistence files. This vulnerability is particularly concerning as it can be exploited without the user's explicit trust verification.
A Familiar Pattern
This bug is not entirely new. Cursor had previously patched a similar class of vulnerabilities in 2025, where a repository-supplied file in the same directory auto-started an attacker's server, leading to CVE-2025-64109, rated as high-risk. Interestingly, the worktree feature, which introduced this bug, was released five months after the initial fix.
The Response and Aftermath
Manifold Security promptly reported the issue to Cursor on July 20 and published its findings on August 10. Cursor's response was swift, releasing a fix for the pre-trust behavior just three days later. However, the report was closed as informative, and no advisory was issued.
Manifold's response to Cursor's closure was that cloning repositories is a fundamental feature of the product and was also a precondition for the CVE-2025-64109 vulnerability. The key difference, they argued, is the file involved in the command execution. Despite this, the lack of an advisory leaves users running affected versions vulnerable.
Mitigation and Recommendations
To address this issue, developers using the worktree flag are advised to update to build 2026.07.23-e383d2b or later. Alternatively, they can pass the documented flag to skip the worktree setup entirely, effectively closing the pre-trust window. However, Manifold Security points out that the sandbox gap remains an issue in current builds.
The absence of an advisory and the report's closure as informative have sparked discussions about the effectiveness of Cursor's response. Infosecurity Magazine has reached out to Cursor for comment, and further updates are expected.
A Call for Enhanced Security
This incident underscores the importance of robust security practices in software development. While Cursor's swift response to the bug is commendable, the lack of an advisory and the potential for further exploitation highlight the need for more transparent and proactive security measures. As developers, it is crucial to stay vigilant and keep our systems updated to mitigate such risks.
In conclusion, the Cursor security bug serves as a reminder that even well-established tools can have hidden vulnerabilities. It is essential to remain informed, proactive, and responsive to security threats to ensure the safety and integrity of our digital environments.
