{"id":102,"date":"2026-10-29T06:59:28","date_gmt":"2026-10-29T06:59:28","guid":{"rendered":"https:\/\/bugskan.com\/?p=102"},"modified":"2026-10-29T06:59:29","modified_gmt":"2026-10-29T06:59:29","slug":"cursor-repository-opening-risk-involved-automatic-tasks-and-workspace-trust","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/cursor-repository-opening-risk-involved-automatic-tasks-and-workspace-trust\/","title":{"rendered":"Cursor repository-opening risk involved automatic tasks and workspace trust"},"content":{"rendered":"<p>The Hacker News reported on Oasis Security research into Cursor\u2019s handling of workspace trust. A crafted repository could contain a task configured to run when its folder opened, creating a path to local code execution.<\/p>\n<p>The reported mechanism concerned editor task execution and security defaults. It is distinct from the MCPoison configuration-approval issue and does not require treating every AI-related repository incident as one vulnerability.<\/p>\n<p>Review workspace-trust settings and automatic tasks before opening unfamiliar repositories. Use a maintained editor release and an isolated environment when examining untrusted code; this historical report does not establish the behavior of every current Cursor version.<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2025\/09\/cursor-ai-code-editor-flaw-enables.html\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>September 2025 research described how a malicious repository could exploit permissive task-execution defaults.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_79e6fa79207e61","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"medium","bugskan_affected_scope":"Repository-triggered editor tasks under the configuration described in the 2025 research.","bugskan_recommended_next_step":"Review workspace trust and folder-open tasks before opening unfamiliar repositories.","bugskan_who_should_check":"","bugskan_material_updated_at":"2025-09-12T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[34],"class_list":["post-102","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-cursor"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=102"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/102\/revisions"}],"predecessor-version":[{"id":331,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/102\/revisions\/331"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=102"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=102"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}