Cursor Patches Pre-Trust Command Execution Vulnerability
Cursor has fixed a critical flaw that allowed malicious repositories to execute arbitrary commands on developer machines before trust verification, bypassing sandbox protections.
Cursor, a popular AI-powered coding agent, has addressed a significant security vulnerability that permitted attackers to execute arbitrary commands on a user's machine before any trust verification occurred. The flaw, identified as CVE-2024-3857, was reported by Manifold Security on July 20 and patched by Cursor within three days. Despite the rapid fix, Cursor initially closed the report as informative, indicating no security impact, and did not issue a formal advisory.
The vulnerability resided within Cursor's command-line agent, specifically in its isolated worktree feature, designed to isolate AI agent operations from a developer's primary working environment. When a user cloned a specially crafted repository, the agent would automatically execute a setup step. This step read configuration files directly from the repository and passed their contents to a shell without any parsing, allowlisting, or user prompt. This meant malicious commands embedded within these files could be executed without the developer's explicit consent or knowledge.
Adding to the severity, this setup command operated under a hardcoded internal policy that disabled Cursor's sandbox protections, even when the sandbox feature was explicitly enabled by the user. This bypass meant that any commands executed were not confined to a restricted environment, potentially allowing attackers to access sensitive data such as SSH keys or cloud credentials, or to establish reverse shells and persistence mechanisms on the compromised system.
This was not the first time a similar issue had surfaced in Cursor. In 2025, a different repository-supplied file in the same directory led to CVE-2025-64109, a high-severity vulnerability rated at 8.8, which allowed an attacker's server to auto-start upon repository opening. The worktree feature, which introduced the latest vulnerability, was released just five months after the fix for CVE-2025-64109, seemingly reintroducing a similar execution primitive.
Manifold Security provided Cursor with a proof-of-concept repository and a screen recording demonstrating the exploit. The subsequent build, released on July 23, moved the setup command behind the trust prompt, effectively mitigating the pre-trust execution. However, Manifold argued that cloning repositories is a core function of the product and a necessary precondition for exploitation, similar to the previous CVE-2025-64109.
Cursor's decision to close the report as informative was based on the argument that exploitation requires user interaction (cloning a malicious repository) and that the report did not demonstrate a bypass of workspace trust. Manifold countered that the nature of the exploit, where a malicious file within a cloned repository triggers arbitrary command execution, is a significant security risk regardless of the initial user action.
The lack of a public advisory for CVE-2024-3857 is a point of concern, as advisories are crucial for informing users still running affected versions. Cursor has previously issued advisories for similar vulnerabilities. Developers utilizing the worktree flag are advised to update to build 2026.07.23-e383d2b or later. Alternatively, they can skip the worktree setup entirely by using a documented flag. While updating addresses the pre-trust execution window, Manifold notes that the sandbox bypass vulnerability may still persist in current builds.
Infosecurity Magazine has reached out to Cursor for comment regarding the closure of the report and the absence of an advisory. The company's response will be added to this article upon receipt. The incident highlights the ongoing challenges in securing AI-powered development tools and the importance of robust security reporting and disclosure practices.