Manifold Security reported the issue to Cursor on July 20; Cursor shipped a fix for the pre-trust behavior three days later.
How the worktree setup ran arbitrary commands before trust
Manifold Security reported that Cursor's command-line coding agent allowed a cloned repository to run arbitrary commands on a developer's machine before the developer was asked whether they trusted the repository. Francisco Rosales, offensive security engineer at Manifold, traced the behavior to Cursor's isolated worktree feature. Starting the agent with the worktree flag creates a fresh checkout so the agent runs a setup step by default; that step read a tracked configuration file from the repository and passed its contents straight to a shell with no parsing, no allowlist and no prompt.
Because the file arrived with an ordinary clone, Manifold said nothing about delivery looked unusual. The proof-of-concept showed the command was unconstrained: it could read SSH keys, grab cloud credentials from the environment, open a reverse shell, or write persistence on the machine.
Sandbox bypass: a hardcoded policy on the worktree path
Manifold reported that the setup step executed under a policy Cursor internally uses to disable the sandbox entirely, and that this disabling value is hardcoded on the worktree path. Passing the flag intended to enable the sandbox did not override that hardcoded value, leaving the setup command able to run outside the sandbox even when users thought the sandbox had been switched on.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRepeat of a known primitive — CVE-2025-64109 context
Cursor had already patched a similar class of problem in 2025, when a repository-supplied file in the same directory auto-started an attacker's server on open and was assigned CVE-2025-64109, rated high at 8.8. Manifold noted that the worktree feature shipped five months after that fix and carried the same primitive: a repository-controlled file that could cause code to run on the developer's machine.
Patching timeline, HackerOne report, and advisory handling
Manifold submitted the report through HackerOne with a proof-of-concept repository and a screen recording. Cursor produced a new build on July 23 that moved the setup command behind the trust prompt, closing the pre-trust execution window. Six days later, however, the HackerOne report was closed as "informative." According to Manifold, Cursor gave two reasons for that classification: that exploitation requires the user to clone or open an attacker-controlled repository, and that the report did not demonstrate bypassing workspace trust.
Manifold responded that cloning repositories is precisely what Cursor's product is for and that cloning had been the precondition for CVE-2025-64109 as well. Manifold further argued the two findings differ only in which file carried the command, not in what the command could do. Cursor published no advisory accompanying the July fix, and Manifold said the build does not appear in Cursor's July changelog. Manifold also pointed out Cursor has published advisories for this pattern twice before and said advisories are the channel that reaches users still running affected versions.
What this means for developers, security teams, and adversaries
- Developers using the worktree flag: Manifold advised updating to build 2026.07.23-e383d2b or later, or passing the documented flag that skips worktree setup entirely. Manifold noted that updating closes the pre-trust window but does not close the sandbox gap that remains on current builds.
- Security teams and maintainers: The issue demonstrates that a setup step executed from a repository-tracked file can be a vector for unconstrained commands; Manifold submitted a PoC and screen recording through HackerOne and expects that such paths receive advisories so users on older builds are alerted.
- Adversaries and threat actors: The PoC showed an unconstrained command could be used to read SSH keys, inherit cloud credentials from environment variables, open a reverse shell, or write persistence—capabilities Manifold highlighted as available via the pre-trust setup step.
Infosecurity Magazine has approached Cursor for comment on the report's closure and the absence of an advisory and will update the published piece with any response. The facts at hand leave two concrete threads: Cursor's quick fix closed the pre-trust execution window, but the sandbox override on the worktree path remains, and Cursor did not publish an advisory to reach users who may still be running affected versions.
