Executive Summary

This vulnerability exists in Cursor versions 1.7.23 and below, where a logic bug allows a malicious agent to read sensitive files that should be protected by the cursorignore configuration. An attacker who has already performed prompt injection or a malicious model can create a new cursorignore file that invalidates existing configurations, thereby enabling access to protected files. This issue is fixed in version 2.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a malicious agent to bypass file protection mechanisms and read sensitive files that should be ignored by the cursorignore configuration. This could lead to unauthorized disclosure of sensitive information, potentially compromising data confidentiality and security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Cursor to version 2.0 or later, as this version fixes the vulnerability related to the logic bug allowing malicious agents to read protected files by invalidating cursorignore configurations.

Useful 0 Not Useful 0