Cursor Code Editor Path Manipulation Vulnerability Leading to Remote Code Execution on Windows

A remote code execution vulnerability has been identified in the Cursor code editor, specifically in versions through 1.7.52. The issue arises from improper detection of path manipulation using backslashes, which allowed an attacker with prompt injection or similar control to overwrite sensitive editor files on Windows without required approval. This vulnerability exploits the application's internal settings management, bypassing safeguards that are normally triggered by forward slashes.

Impact

The vulnerability could be exploited to achieve remote code execution, particularly on Windows systems, by overwriting sensitive editor files. This manipulation could potentially be combined with prompt injection or the use of a malicious model to execute arbitrary code.

Remediation

Users should update to Cursor version 2.0, where this vulnerability has been addressed.