Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

mindgard.ai

Post reply on HN
Print view View original

111–120 of 222 posts

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#111

Post by jeremyjh »

paxys wrote: post #104
AussieWog93 wrote: post #98

Earlier quoted context omitted.

The difference is that I expect "npm install" to execute code, where I do not expect merely opening a repo to look at the files in Cursor to execute anything.

IDEs do syntax highlighting, typechecking, linting, automatic git refreshes. All of this happens in the background without you executing any code. If you open a Typescript project in VS Code and it automatically shows you a list of errors where do you think it got them from? It ran the tsc executable in your node_modules folder.

> syntax highlighting, typechecking, linting, automatic git refreshes

In most languages, none of those things involve execution of code in the repo. In languages that do - for example Elixir - it prompts you to trust them first.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#113

Post by ncruces »

bragr wrote: post #49

I think this is slightly less of a Cursor bug than a bit of a Windows quirk: Windows searches the current working directory for executables before resorting to the path variable. I imagine a lot of stuff is vulnerable to such an "attack" on Windows.

Stuff that cares about security fixes this, though:

https://go.dev/blog/path-security

The functions Command and LookPath look for a program in the directories listed in the current path, following the conventions of the host operating system. Operating systems have for decades included the current directory in this search, sometimes implicitly and sometimes configured explicitly that way by default. Modern practice is that including the current directory is usually unexpected and often leads to security problems.

https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_di...

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#115

Post by ivirshup »

oceansweep wrote: post #79
khurs wrote: post #70

Earlier quoted context omitted.

Perhaps its a intentional back door? NSA/FBI puts a git.exe in GitHub for a target. Target pulls the repo and it executes the payload. As Cursor is/was based on VS Code, does it happen in VS Code too?

It’s a thing in VSCode as well/has been a thing or things similar to it : https://www.threatlocker.com/blog/malicious-vs-code-tasks-js... (2026) https://www.reddit.com/r/programming/comments/zes1co/visual_... (2022)

I think those are both different in that they require the user to say they trust this code. Additionally the first is arguably not a bug (the code in tasks.json will indeed run if you say you trust the project) and the second was reported and fixed within two months.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#117

Post by yieldcrv »

Why do you guys write essays to justify doing the leak

Have you all drunk too much psyop koolaid?

Three things are obvious:

1 - “Responsible disclosure” by a unilaterally proscribed process only benefits an abuser

2 - The abuser sets a price for the disclosure that is arbitrary and parallel to its market value, the attractiveness is based solely on your vulnerability to how much the abuser can abuse you with the state

3 - The vulnerability’s continued existence isn't necessarily a breakdown of disclosure processes, it could literally be malice. congratulations you found the honeypot, it wont be confirmed by the state for 70 years

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#118

Post by [deleted] »

petalmind wrote: post #84
taneq wrote: post #76

Earlier quoted context omitted.

I’ve never got my head around how it’s apparently the done thing these days to just copy a bash command from a website and run it (sometimes with sudo! O.o ) to install software. I somewhat naively hope that this is because everyone is pushing single purpose VMs for that kind of install, but really I know better.

> to just copy a bash command from a website and run it (sometimes with sudo! O.o ) to install software. how is that different from the good old days of wget ftp://ftp.something.org/software-2.10.tar.gz tar zxfv ./configure make sudo make install ?

[deleted]

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#119

Post by mh- »

Terr_ wrote: post #93
petalmind wrote: post #84

Earlier quoted context omitted.

> to just copy a bash command from a website and run it (sometimes with sudo! O.o ) to install software. how is that different from the good old days of wget ftp://ftp.something.org/software-2.10.tar.gz tar zxfv ./configure make sudo make install ?

Training people (esp. what passes for non-techies on Linux) to regularly copy-paste into the terminal is massively riskier than "click this URL". Just for starters, consider how easily you can make a web-page where you highlight X to copy it, but instead Y is delivered to your clipboard. Then on execute it could even redraw the terminal to pretend you pasted X all along. Also, there's a convention or social-contract…

> Then on execute it could even redraw the terminal to pretend you pasted X all along.

Diabolical idea. Anyone know if there's been anything in the wild that did this?

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#120

Post by VTimofeenko »

mh- wrote: post #119
Terr_ wrote: post #93

Earlier quoted context omitted.

Training people (esp. what passes for non-techies on Linux) to regularly copy-paste into the terminal is massively riskier than "click this URL". Just for starters, consider how easily you can make a web-page where you highlight X to copy it, but instead Y is delivered to your clipboard. Then on execute it could even redraw the terminal to pretend you pasted X all along. Also, there's a convention or social-contract…

> Then on execute it could even redraw the terminal to pretend you pasted X all along. Diabolical idea. Anyone know if there's been anything in the wild that did this?

[dead]
Post reply on HN