Get the latest tech news
This 'critical' Cursor security flaw could expose your code to malware - how to fix it
A feature being disabled by default could leave users and their organizations vulnerable to commands that run automatically.
"This has the potential to leak sensitive credentials, modify files, or serve as a vector for broader system compromise, placing Cursor users at significant risk from supply chain attacks," Oasis wrote. Without it, the platform will automatically run code that's in a repository, leaving the window open for bad actors to surreptitiously slip in malware that could then jeopardize a user's system -- and from there, potentially spread throughout a broader network. In a statement to Oasis that was published in the report, Cursor said that its platform operates with Workplace Trust deactivated by default since it interferes with some of the core automated features that users routinely depend on.
Or read this on ZDNet