A security flaw in Cursor's command-line coding agent allowed malicious code from a cloned repository to execute on a developer's machine without prior trust verification or proper sandboxing. The vulnerability, discovered by Francisco Rosales of Manifold Security, was reported to Cursor on July 20 and publicly disclosed on August 10.
The issue resided in Cursor's "isolated worktree" feature, designed to keep an AI agent separate from a developer's primary working tree. When the agent was initiated with the worktree flag, it automatically performed a setup step. This step involved reading a configuration file from the cloned repository and directly passing its contents to a shell, without any parsing, allowlisting, or user prompt. This allowed any command within the configuration file to run immediately upon cloning.
Manifold Security highlighted the broad scope of potential exploitation, noting that an attacker could use this to read SSH keys, extract cloud credentials, establish a reverse shell, or achieve persistence on the compromised system. The setup process also ran under a hardcoded policy that effectively disabled the sandbox, meaning that even if a user explicitly enabled sandboxing, it would not override this behavior.
Cursor released a fix for the pre-trust execution aspect of the vulnerability three days after Manifold Security's report, on July 23, with build 2026.07.23-e383d2b. This update moved the setup command behind a trust prompt, requiring user consent before execution. However, Manifold Security stated that the sandbox bypass issue remains unpatched in current builds.
Despite the fix, Cursor closed the security report as "informative," asserting that exploitation required a user to clone or open an attacker-controlled repository and that the report did not demonstrate a bypass of workspace trust. Manifold Security countered that cloning repositories is a fundamental function of the product and that similar preconditions existed for a previous vulnerability.
This is not the first time Cursor has faced such a vulnerability. In 2025, a repository-supplied file in the same directory caused an attacker's server to auto-start upon opening, leading to CVE-2025-64109, which received a high severity rating of 8.8. Manifold Security noted that the worktree feature, which carried the current flaw, was introduced five months after the fix for CVE-2025-64109, effectively reintroducing a similar primitive.
Cursor did not publish a security advisory for the recent fix, nor was the build mentioned in its July changelog. Manifold Security emphasized the importance of advisories for informing users running affected versions, pointing out that Cursor had published advisories for similar patterns twice before. Developers using the worktree flag are advised to update to build 2026.07.23-e383d2b or later, or to use the flag that completely skips worktree setup.
