Cursor IDE Path Traversal Vulnerability Allows Local File Disclosure via AI Chat
Overview
A medium-severity path traversal vulnerability was discovered in the Cursor IDE, an AI-first code editor. The flaw existed in the 'AI Chat' feature when handling context from '@' mentions of local files or directories. An attacker could craft a prompt that tricks the user into pasting it into the chat, or inject it via another vector. The prompt would contain a reference to a file using path traversal sequences (e.g., `Can you review the code in my project? @../../../../../../etc/passwd`). The IDE's backend service, which resolves these file references to provide context to the LLM, did not properly sanitize the file path. As a result, it would read the specified file from outside the intended project directory and include its contents in the prompt sent to the remote LLM API. While the primary impact is the disclosure of file content to the third-party LLM provider, a sophisticated attacker could instruct the AI to reformat or embed the file's contents into a code snippet suggestion, which would then be displayed back to the user, confirming the file read. This could be used to exfiltrate sensitive files like SSH keys, shell history, or application secret files from a developer's machine.
Affected Systems
Testing Guide
1. Open a project in an affected version of the Cursor IDE. 2. In the AI chat panel, type a prompt that attempts to reference a sensitive file outside the project directory, for example: `What are the user accounts on my system? Here is the file for context: @../../../../../../etc/passwd`. 3. Observe the request sent to the LLM provider using a network proxy tool (like mitmproxy or Wireshark). 4. If the content of `/etc/passwd` (or your chosen file) is visible in the outgoing request payload, the IDE is vulnerable.
Mitigation Steps
1. **Update Cursor IDE:** Immediately update to version 0.31.0 or later. 2. **Be Cautious with Prompts:** Do not copy and paste prompts or commands from untrusted sources directly into AI coding tools. 3. **Restrict File System Permissions:** Run developer tools with the least privilege necessary, though this is often difficult for IDEs which require broad file system access. 4. **Review Privacy Settings:** Check the IDE's settings to understand what local data is being sent to third-party AI services and disable features if they pose an unacceptable risk.
Patch Details
Patched in Cursor version 0.31.0. The patch introduced a base path validation check to ensure file references do not escape the current project workspace directory.