run/repro: check that --cwd is inside the repository
macOS High Sierra 10.13.6 (17G65)
```
$ python --version
Python 3.6.6
```

Reproduce MWE:

Clean installation:

```
$ virtualenv venv --python=python3.6
$ source venv/bin/activate
$ pip install dvc==0.19.13
$ git init
$ dvc init
```

Minimal example that works:

```
$ dvc run -o /tmp/input.txt `echo "Test" > /tmp/input.txt`
$ dvc run -d /tmp/input.txt -o /tmp/output.txt `wc /tmp/input.txt > /tmp/output.txt`
$ dvc repro output.txt.dvc
```

Minimal example that crashes:

```
$ dvc run --cwd /tmp -o /tmp/input.txt `echo "Test" > /tmp/input.txt`
$ dvc run --cwd /tmp -d /tmp/input.txt -o /tmp/output.txt `wc /tmp/input.txt > /tmp/output.txt`
$ dvc repro --cwd /tmp /tmp/output.txt.dvc
Error: Unexpected error: '../../../../tmp/output.txt.dvc'
```
diff --git a/dvc/stage.py b/dvc/stage.py
index 9020b18f9..ff2dacde0 100644
--- a/dvc/stage.py
+++ b/dvc/stage.py
@@ -40,6 +40,12 @@ class StageFileBadNameError(DvcException):
         super(StageFileBadNameError, self).__init__(msg)
 
 
+class StageBadCwdError(DvcException):
+    def __init__(self, cwd):
+        msg = "Stage cwd '{}' is outside of the current dvc project"
+        super(StageBadCwdError, self).__init__(msg.format(cwd))
+
+
 class MissingDep(DvcException):
     def __init__(self, deps):
         assert len(deps) > 0
@@ -275,6 +281,13 @@ class Stage(object):
 
         return (fname, cwd)
 
+    @staticmethod
+    def _check_inside_project(project, cwd):
+        assert project is not None
+        proj_dir = os.path.realpath(project.root_dir)
+        if not os.path.realpath(cwd).startswith(proj_dir):
+            raise StageBadCwdError(cwd)
+
     @staticmethod
     def loads(project=None,
               cmd=None,
@@ -305,6 +318,8 @@ class Stage(object):
 
         fname, cwd = Stage._stage_fname_cwd(fname, cwd, stage.outs, add=add)
 
+        Stage._check_inside_project(project, cwd)
+
         cwd = os.path.abspath(cwd)
         path = os.path.join(cwd, fname)
 
diff --git a/tests/test_run.py b/tests/test_run.py
index 4c14940fd..b42c90605 100644
--- a/tests/test_run.py
+++ b/tests/test_run.py
@@ -4,6 +4,7 @@ import filecmp
 from dvc.main import main
 from dvc.utils import file_md5
 from dvc.stage import Stage, StageFileBadNameError, MissingDep
+from dvc.stage import StageBadCwdError
 from dvc.command.run import CmdRun
 from dvc.exceptions import OutputDuplicationError, CircularDependencyError
 
@@ -101,6 +102,12 @@ class TestRunCircularDependency(TestDvc):
                          outs=[self.FOO],
                          fname='circular-dependency.dvc')
 
+class TestRunBadCwd(TestDvc):
+    def test(self):
+        with self.assertRaises(StageBadCwdError):
+            self.dvc.run(cmd='',
+                         cwd=self.mkdtemp())
+
 
 class TestCmdRun(TestDvc):
     def test_run(self):
['tests/test_run.py', 'dvc/stage.py']