Cursor Agent arbitrary file write via prompt injection in @Docs
A regression in Cursor versions 0.45.0-0.48.6 allowed the Cursor Agent to write files outside of the opened workspace through prompt injection in maliciously crafted @Docs content. The vulnerability required deliberate prompting and was patched in version 0.48.7.
What happened
A regression in Cursor versions 0.45.0 through 0.48.6 allowed the Cursor Agent to write files outside of the opened workspace when prompted directly by users or via maliciously crafted context in @Docs features.
The vulnerability required deliberate prompting to exploit and displayed edited files in the UI for user review before writing.
Reported impact
An attacker could cause the agent to automatically write to files outside the intended workspace.
Index analysis
The vulnerability stemmed from improper input validation (CWE-20) in the Cursor Agent's file path restrictions.
Cursor patched the issue in version 0.48.7 by requiring explicit user confirmation before writing to out-of-workspace files.
Governance controls
Cursor recommends users only include trusted pieces of context in prompts and always review edits made by the agent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.