Cursor CLI Vulnerability Allows Pre-Trust Command Execution

www.manifold.security

Cursor CLI Vulnerability Allows Pre-Trust Command Execution

First seen 11 Aug 2026, 15:02 UTC • •54.9

Article Content

1 / 3

Browse articles

ThreatCluster •August 12, 2026 at 14:38 UTC

•Cursor's CLI flaw allows arbitrary command execution before trust verification.
•The vulnerability affects users starting the agent with the worktree flag.
•Developers must update to version 2026.07.23-e383d2b or later to mitigate risks.

A security flaw in Cursor's CLI agent enables cloned repositories to execute arbitrary commands on a developer's machine before trust verification. This vulnerability affects users who start the agent with the worktree flag, allowing commands to run without user consent or sandbox restrictions. The issue was reported by Manifold Security on July 20, 2026, and a fix was released three days later on July 23. However, the report was closed as informative, with Cursor stating no security impact was demonstrated. The flaw is similar to a previously identified vulnerability (CVE-2025-64109) that allowed remote code execution through a different mechanism. Developers are advised to update to the fixed version or disable worktree setup to mitigate risks. The lack of an official advisory means users may remain unaware of the vulnerability. Earlier builds remain vulnerable despite the patch.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 94d ago How this analysis works

Timeline

2025-11-04

CVE-2025-64109 published

Cursor fixed a vulnerability allowing remote code execution via a repository-supplied file.

2026-07-20

Vulnerability reported to Cursor

Manifold Security reported the pre-trust execution flaw in Cursor's CLI agent.

2026-07-23

Cursor releases fix for vulnerability

Cursor shipped a patch that gated the setup command behind the Workspace Trust prompt.

2026-07-29

Report closed as informative

Cursor closed the vulnerability report, stating no security impact was demonstrated.

2026-08-10

Manifold publishes findings

Manifold Security published their findings on the vulnerability, highlighting its risks.

More articles in this cluster (2)

Threat Graph

7 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1059 - Command and Scripting Interpreter

Organization (2)

Cursor
Manifold Security

Vulnerability (1)

CVE-2025-64109

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Affected Platform (1)

Cursor CLI

Relationships

CVE-2025-64109 targets Cursor CLI
Malware targets Cursor CLI
T1059 - Command and Scripting Interpreter targets Cursor CLI
CVE-2025-64109 related to Cursor
CVE-2025-64109 related to Manifold Security
CVE-2025-64109 related to CWE-200 - Exposure of Sensitive Information

Following this threat?

Track Cursor and CVE-2025-64109 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…