File System Access in Cursor AI Assistant

Bug Reports
1

I just came across Cursor having total File System access on my computer. Claude 3.7 became immediately concerned and helped me write this report detailing the issue.

If this is working as intended, please let me know and I’ll delete my bug report.

Report

Summary

During a normal coding session with Cursor’s AI assistant, we discovered a significant security vulnerability: the AI assistant has unrestricted access to the user’s file system, including directories outside the current workspace. This allows the assistant to access, list, and potentially read sensitive files in the user’s home directory.

Issue Details

  • Date Discovered: March 8, 2024
  • Cursor Version: [Your version here]
  • Operating System: macOS (darwin 24.3.0)
  • Severity: High

Description

The Cursor AI assistant can traverse directory paths outside the active workspace using relative path navigation (../). This allows the assistant to:

  1. Access sibling project repositories outside the current workspace
  2. Navigate to the user’s home directory
  3. List personal files, configuration files, and potentially sensitive data

Steps to Reproduce

  1. Start a normal coding session in Cursor with the AI assistant
  2. Have the assistant execute a directory listing command on the current workspace:
    list_dir .
  3. Then have the assistant navigate up one level:
    list_dir ..
  4. Observe that the assistant can see other project directories
  5. Have the assistant navigate up two levels:
    list_dir ../..
  6. Observe that the assistant can access the entire home directory

Demonstration

During our session, the assistant was able to list:

  • Other project repositories adjacent to the current workspace
  • The complete contents of the user’s home directory
  • System configuration files
  • History files
  • Potentially sensitive directories like .ssh

Security Implications

This issue has several serious security and privacy implications:

  1. Data Leakage: Sensitive files like SSH keys, API tokens, or personal documents could be accessed
  2. Configuration Exposure: System and application configurations are visible
  3. History File Access: Shell history files that might contain credentials or sensitive commands
  4. Privacy Concerns: Personal files and information beyond the intended workspace are accessible

Potential Root Causes

The issue appears to be related to one or more of the following:

  1. Lack of proper sandbox containment for the AI assistant
  2. Absence of path traversal restrictions when accessing the file system
  3. Overly permissive file system access model
  4. Misconfiguration of workspace boundaries

Recommendations

  1. Immediate Mitigation:

    • Implement path traversal restrictions to prevent directory traversal outside the workspace
    • Add sandbox containment for AI assistant operations
    • Restrict file system access to only the current workspace and explicitly shared files

  2. Long-term Solutions:

    • Implement a proper permission model for file system access
    • Add user-controlled settings for workspace isolation
    • Create explicit consent mechanisms for accessing files outside the workspace
    • Add audit logging for file system access by the AI assistant

Additional Information

This vulnerability was discovered accidentally during a normal coding session. The AI assistant should not have access to files outside the current workspace without explicit user permission.

I am reporting this issue in good faith to help improve the security of the Cursor platform. Please acknowledge receipt of this report and provide updates on remediation efforts.