Hacker News Reader

On Windows, if your shell was in a malicious repo's directory and you ran any "git" command, wouldn't the behavior be the same? Binaries in the current directory are considered before PATH. This seems like a broader issue.

That said, Cursor should at least have some "trust this directory?" dialogue.

View on HN

Not in powershell, no, because . is not in PATH (unless you put it there).

If you tab-complete `git` it will resolve to `.\git.exe` but it you merely hit enter then it will search PATH and not the CD.

great point! Though what about the default windows APIs for 'calling out to shell'. Like using `subprocess.run(...)` in Python. My suspicion is that works like cmd.exe?

edit: answered myself. Seems like subprocess.run works like PowerShell, unless you pass in 'shell=True', then it passes it directly to CMD.exe. And I'm guessing that's what Cursor is doing.

Reply on news.ycombinator.com