Cross-Site Scripting (XSS) and Local File Read in Cursor IDE via Malicious Markdown Rendering
Overview
A high-severity vulnerability was discovered in the popular AI-native code editor, Cursor IDE. The issue resides in the integrated webview used to render Markdown files for features like 'Chat with Docs' and documentation previews. The renderer failed to properly sanitize embedded HTML and JavaScript content within Markdown files. An attacker could craft a malicious `README.md` file containing a payload, such as an `<img>` tag with an `onerror` attribute or a direct `<script>` block. When a developer opens a project containing this file and views it within Cursor, the malicious JavaScript executes in the context of the IDE's local webview. This sandboxed context, however, was found to have overly permissive access to the local filesystem via insecurely exposed Node.js APIs. The script could then initiate requests to read sensitive local files, such as `~/.ssh/id_rsa`, `~/.aws/credentials`, or shell history files. The stolen data could be exfiltrated to an attacker-controlled server via a simple `fetch()` request. This attack vector is particularly dangerous as developers frequently clone and inspect untrusted repositories from sources like GitHub, making them susceptible to opening a malicious project that triggers the exploit.
Affected Systems
Testing Guide
1. Create a new `test.md` file in a project. 2. Add a simple XSS payload to the file, such as: `<script>alert('Vulnerable to XSS')</script>` or `<img src=x onerror=alert('Vulnerable!')>`. 3. Open the project in a vulnerable version of Cursor IDE and view the rendered `test.md` file. 4. If an alert box appears, the application is vulnerable to XSS. A more advanced test would involve trying to read a local file using `fetch('file:///etc/passwd')` and logging the result to the console.
Mitigation Steps
1. **Update Cursor IDE**: Immediately update to version `0.25.0` or newer, which includes a patched Markdown rendering engine with stricter sanitization and webview sandboxing. 2. **Be Cautious with Untrusted Repositories**: Avoid cloning and opening projects from unknown or untrusted sources. If you must inspect one, use a standard text editor first to review potentially malicious files like `README.md`. 3. **Configure a Content Security Policy (CSP)**: For developers of similar applications, implement a strict CSP for all webview components to prevent the execution of inline scripts and restrict outbound network requests. 4. **Disable JavaScript in Previews**: If your editor allows, disable JavaScript execution in Markdown previews as a precautionary measure.
Patch Details
Patched in version 0.25.0 by upgrading the Markdown parser and strengthening the webview sandbox.