cursor-appimage

MEDIUM

maintainer ali.molaei 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.cursor.com), which is an unverifiable executable artifact; if compromised, it could lead to code execution during extraction or runtime.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.cursor.com), which is an unverifiable executable artifact; if compromised, it could lead to code execution during extraction or runtime.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kewl fft <kewl@alto.eu.org>
    
      2
    
      3pkgname=cursor-appimage
    
      4pkgver=3.19.13
    
      5pkgrel=1
    
      6_ver=3.19
    
      7_commit="dd066f332fcea7382764400fde902f61920648d5"
    
      8pkgdesc="Cursor AI code editor (AppImage, extracted)"
    
      9arch=('x86_64')
    
      10url="https://www.cursor.com"
    
      11license=('custom')
    
      12depends=('glibc' 'gtk3' 'nss' 'libxss' 'alsa-lib')
    
      13conflicts=('cursor-bin')
    
      14provides=('cursor')
    
      15options=(!strip)
    
      16_watch=(
    
      17  'https://api2.cursor.sh/updates/download/golden/linux-x64/cursor/${_ver}' 'header' 'regex' 'Cursor-([0-9.]+)-x86_64.AppImage' 'pkgver'
    
      18  'https://api2.cursor.sh/updates/download/golden/linux-x64/cursor/${_ver}' 'header' 'regex' 'location:.*production/([a-f0-9]+)/' '_commit'
    
      19)
    
      20
    
      21source=(
    
      22  "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"
    
      23)
    
      24
    
      25sha512sums=('3fb9c5f8c3bc4dadae81f39a0c58ac742a7b7260358b46c832c5e0974685350095de5aec7ce882473b341fcbbe755839a619b46f98cb70715ee15d7ce057416e')
    
      26
    
      27prepare() {
    
      28  cd "${srcdir}"
    
      29  chmod +x Cursor-${pkgver}.AppImage
    
      30  ./Cursor-${pkgver}.AppImage --appimage-extract
    
      31}
    
      32
    
      33package() {
    
      34  install -d "${pkgdir}/opt/cursor"
    
      35  cp -a squashfs-root/* "${pkgdir}/opt/cursor/"
    
      36
    
      37  # --- FIX APPIMAGE ---
    
      38  # Replace broken AppRun with working launcher
    
      39  cat > "${pkgdir}/opt/cursor/AppRun" <<'EOF'
    
      40#!/bin/bash
    
      41HERE="$(cd "$(dirname "$0")" && pwd)"
    
      42
    
      43export PATH="$HERE/usr/bin:$PATH"
    
      44export LD_LIBRARY_PATH="$HERE/usr/lib:$HERE/usr/lib64:$HERE/lib:$LD_LIBRARY_PATH"
    
      45export XDG_DATA_DIRS="$HERE/usr/share:$XDG_DATA_DIRS"
    
      46
    
      47exec "$HERE/usr/share/cursor/cursor" "$@"
    
      48EOF
    
      49
    
      50  chmod +x "${pkgdir}/opt/cursor/AppRun"
    
      51
    
      52  # chrome sandbox (required by Electron)
    
      53  if [[ -f "${pkgdir}/opt/cursor/chrome-sandbox" ]]; then
    
      54    chmod 4755 "${pkgdir}/opt/cursor/chrome-sandbox"
    
      55  fi
    
      56
    
      57  # CLI launcher
    
      58  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/cursor" <<'EOF'
    
      59#!/bin/bash
    
      60exec /opt/cursor/AppRun "$@"
    
      61EOF
    
      62
    
      63  # Desktop entry
    
      64  install -Dm644 squashfs-root/cursor.desktop \
    
      65    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      66
    
      67  sed -i 's|^Exec=.*|Exec=cursor %F|' \
    
      68    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      69
    
      70  sed -i 's|^Icon=.*|Icon=cursor|' \
    
      71    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      72
    
      73  # Icons
    
      74  for size in 16 32 48 64 128 256 512; do
    
      75    icon="squashfs-root/usr/share/icons/hicolor/${size}x${size}/apps/cursor.png"
    
      76    [[ -f "$icon" ]] && install -Dm644 "$icon" \
    
      77      "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/cursor.png"
    
      78  done
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-09-07 00:30
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,10 +1,10 @@
 # Maintainer: kewl fft <kewl@alto.eu.org>
 
 pkgname=cursor-appimage
-pkgver=3.19.7
+pkgver=3.19.13
 pkgrel=1
 _ver=3.19
-_commit="90de2327392570a5f5f625c656c6749d228e6437"
+_commit="dd066f332fcea7382764400fde902f61920648d5"
 pkgdesc="Cursor AI code editor (AppImage, extracted)"
 arch=('x86_64')
 url="https://www.cursor.com"
@@ -22,7 +22,7 @@
   "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"
 )
 
-sha512sums=('0e8ea7ed6da3ea1817f98c98d6e5c04de12bfc55cc6e28b6c3fc8485e1d588be68f9ecd69faa32401cea02546d9061893916c84df5280534816fe1cb20a9c800')
+sha512sums=('3fb9c5f8c3bc4dadae81f39a0c58ac742a7b7260358b46c832c5e0974685350095de5aec7ce882473b341fcbbe755839a619b46f98cb70715ee15d7ce057416e')
 
 prepare() {
   cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 07:13:50	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 07:59:42	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2