Cursor TCC Bypass Vulnerability on macOS

A TCC (Transparency, Consent, and Control) bypass vulnerability has been identified in Cursor version 15.4.1 for macOS. The issue arises from the 'RunAsNode' fuse being enabled, which allows local attackers with unprivileged access to execute arbitrary code that inherits TCC permissions granted to Cursor by the user. This exploitation can access TCC-protected resources such as the Documents folder without triggering additional system prompts, potentially masking the attacker's intentions.

Impact

Exploitation of this vulnerability allows access to TCC-protected assets, such as files in the Documents directory, without user consent. The vulnerability could be used to manipulate or exfiltrate sensitive information, creating a privacy risk for macOS users.

Reproduction

The vulnerability can be reproduced by opening a project in Cursor, which triggers a TCC permission request. Once permission is granted, malware can exploit the TCC bypass by injecting code into Cursor that accesses TCC-protected resources, such as the Documents folder, under the guise of the application.