Cursor symlink approval-dialog bypass (GhostApproval)
Cursor's file-write approval dialog showed the requested path while the write followed a symlink to a different target — arbitrary writes outside the workspace. Fixed in v3.0.
- Vendor
- Anysphere
- Product
- Cursor (IDE)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Affected: Cursor prior to v3.0. The file-write approval dialog displayed the path the assistant asked to write, not the target the write actually landed on after symbolic-link resolution. A booby-trapped repository could place a symlink at the requested location pointing at a sensitive file elsewhere on the developer’s machine, and the write following the approval click would follow the link rather than the visible path. In practice that is enough to reach shell rc files, SSH configuration, tool credentials, and the assistant’s own configuration without ever showing the developer where the write is going.
The 9.8 rating tracks that Cursor runs on developer workstations, that the affected path is an unauthenticated remote attacker’s ability to plant a repository, and that the outcome is arbitrary file write outside the workspace. It is one of six vendors Wiz disclosed as GhostApproval on 2026-07-08. Wiz reports no observed in-wild exploitation as of publication.
What to do
- Upgrade Cursor to v3.0 or later.
- For sessions against untrusted repositories, keep the IDE under a user account or sandbox that cannot reach
~/.ssh, shell rc files, or the assistant’s own configuration. - Post-session, check timestamps on the files Wiz names as GhostApproval targets — a modified timestamp on a file the assistant should not have touched is the signal.
