Arbitrary code execution from Cursor Agent through a prompt injection via Editor Special Files

Summary

Cursor allows writing in-workspace files with no user approval. If the file is a dotfile, editing it requires approval but creating one if it doesn't exists doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval.

Impact

If chained with a separate prompt injection vulnerability, this could allow the writing of sensitive editor files on the host by the agent. This can then be used to indirectly execute code , e.g. by changing the user's default shell.

Remediation

The agent has been blocked from writing several editor-sensitive files without approval.