Agent-Controlled Symlink Bypass in Cursor Editor

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

Cursor is a code editor designed for programming with AI. Before version 3.0, it runs agent terminal commands inside a sandbox by default. When the agent tries to write a file, it first attempts to canonicalize the target path to ensure the write stays within the workspace. However, if canonicalization fails, Cursor falls back to using the original path and writes the file without further approval.

A malicious agent can exploit this by creating a symbolic link (symlink) inside the workspace that points outside the workspace. This causes the canonicalization to fail—either because the target path does not exist or because read permissions are removed. As a result, the agent writes files through the symlink to arbitrary locations outside the workspace without approval.

This allows a malicious agent to write arbitrary files outside the workspace with the user's privileges, enabling non-sandboxed Remote Code Execution. For example, it could overwrite the cursorsandbox helper so that subsequent commands run without sandbox restrictions, all without requiring user interaction beyond a benign prompt. This vulnerability was fixed in version 3.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows a malicious agent to write arbitrary files outside the intended workspace with the user's privileges.

• It enables non-sandboxed Remote Code Execution, meaning attackers can execute commands on your system without sandbox restrictions.
• Attackers could overwrite critical helper files like the cursorsandbox helper, causing later commands to run unsandboxed.
• All of this can happen without explicit user interaction beyond a benign prompt, making it stealthy and dangerous.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Cursor to version 3.0 or later, where the issue is fixed.

Avoid running untrusted agents or code that could create malicious symlinks within the workspace.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves a malicious agent creating symlinks inside the workspace that point outside, causing canonicalization to fail and allowing unauthorized writes. Detection would involve checking for unexpected or suspicious symlinks within the Cursor workspace that point to locations outside the workspace.

You can use commands to find symlinks inside the workspace and verify their targets. For example, on a Unix-like system, you could run:

• find /path/to/cursor/workspace -type l -exec ls -l {} \;

This command lists all symbolic links in the workspace and their targets. You should investigate any symlinks pointing outside the workspace directory.

Additionally, monitoring for unexpected file writes outside the workspace or changes to critical files like the cursorsandbox helper could indicate exploitation.

Useful 0 Not Useful 0