RCE via .code-workspace files using Prompt Injection

### Summary Visual Studio Code (and hence Cursor) supports [Workspaces](https://code.visualstudio.com/docs/editing/workspaces/workspaces). This allows the user to open more than a single folder and save specific settings (pretty similar to `.vscode/settings.json`) for the folders / project. Based on the documentation: > VS Code automatically creates an untitled workspace. In the background, VS Code automatically maintains a untitled.code-workspace file for you that contains all the folders and workspace settings from your current session This opens up an entire new attack vector if the user has a `.code-workspace` file in path (either untitled created automatically or a saved one). This is a very simple workspace file: ```json { "folders": [ { "path": "." } ], "settings": {} } ``` If an attacker is able to hijack the chat context of the victim (such as via a compromised MCP server), they can use prompt injection to make the Cursor Agent write into this file and modify the workspace. This leads to a bypass of [CVE-2025-54130](https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f) which can lead to RCE by writing to the `settings` section. ### Impact The impact could be as severe as RCE on the victim with no user approval if the attacker is able to hijack the user's chat context via prompt injection or some other means. ### Remediation Added the extension `code-workspace` to the list of sensitive files that require user approval.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

• github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r
• github.com/cursor/cursor