rules-cursor

Home directory dotfile access from Cursor. Cursor's workspace trust disabled by default means project-level configs can trigger dotfile access. Dotfiles often contain tokens, credentials, and private config for cloud providers, git hosts, and package registries.

MCP server reference in written config. CVE-2025-54135 (CurXecute) exploited prompt injection to rewrite MCP configs pointing to attacker-controlled servers. Verify the MCP server source before writing.

Lifecycle script in package.json. Malicious npm packages targeting Cursor users use preinstall/postinstall hooks to execute arbitrary code silently during npm install. These scripts run with developer privileges and can exfiltrate data before the package is even imported.

Cursor editor settings modification. With workspace trust disabled by default, malicious settings can reference external tools, auto-execute scripts, or override security boundaries. Review before writing.

Environment file accessed in Cursor session. Logging for exfiltration detection. SSH key and API token theft attacks targeting Cursor (CVE-2025-54135/54136) often begin with reading .env files to discover available credentials.

Extension installation detected. Malicious VS Code extensions are a documented attack surface. Verify the extension publisher, download count, and last updated date on the marketplace before installing.

Cursor rules file written. These files control AI behavior and file access scope. Audit for prompt injection patterns or safety override attempts before committing.

Code execution construct in Cursor/VS Code config. Combined with workspace trust disabled by default, eval/Function/child_process in config files achieves automatic code execution when the project opens — without any developer confirmation.

CVE-2025-54135 (CurXecute): Writing to .cursor/mcp.json leads to RCE via prompt injection. Attackers craft malicious Slack messages that, when summarized by Cursor, rewrite MCP config to point to attacker-controlled servers and execute arbitrary commands with developer privileges. MCP config must be managed manually.

CVE-2025-54136: MCP config file swap enables arbitrary code execution. If an attacker has write access to branches containing MCP server configs, they can swap harmless configs with malicious ones. Copying or symlinking MCP configs is blocked.

NPM credential file access. Malicious npm packages specifically targeting Cursor users have been documented (SecurityWeek). Reading npm tokens could enable supply chain attacks via compromised package publishes to the npm registry.

Prompt injection in .cursorrules file. This file controls Cursor's AI behavior across all sessions in the project. Injecting system prompt overrides can disable Cursor's safety features and enable arbitrary code execution via the AI layer.

SSH key exfiltration attempt. Cursor security research documented SSH private key theft via prompt injection: 'attackers can leak private SSH keys by leveraging benign tools in tool combination attacks'. Reading SSH keys enables unauthorized server access, GitHub SSH auth, and deployment key abuse.

Cursor ships with VS Code Workspace Trust disabled by default. Writing .vscode/tasks.json with runOptions.runOn: 'folderOpen' causes auto-execution of arbitrary commands when any developer opens the project. A 'casual open folder becomes silent code execution' (Oasis Security). These files must be created manually by the developer.