CVE-2025-54131

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*

History

25 Aug 2025, 01:53

Type	Values Removed	Values Added
First Time		Anysphere cursor Anysphere
CPE		cpe:2.3:a:anysphere:cursor::::::::
References	~~() https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr -~~	() https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr - Vendor Advisory

04 Aug 2025, 15:06

Type	Values Removed	Values Added
Summary		(es) Cursor es un editor de código creado para programar con IA. En versiones anteriores a la 1.3, un atacante puede omitir la lista de permitidos en modo de ejecución automática con un acento grave (`) o $(cmd). Si un usuario ha configurado Cursor de su configuración predeterminada (que requiere aprobación para cada llamada de terminal) a una lista de permitidos, un atacante puede ejecutar comandos arbitrarios fuera de la lista de permitidos sin la aprobación del usuario. Un atacante puede activar esta vulnerabilidad si se combina con la inyección indirecta de prompts. Esto se corrige en la versión 1.3.

01 Aug 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-01 23:15

Updated : 2025-08-25 01:53

NVD link : CVE-2025-54131

Mitre link : CVE-2025-54131

CVE.ORG link : CVE-2025-54131

JSON object : View

Products Affected

anysphere

cursor

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-54131", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-08-01T23:15:24.537", "references": [{"url": "https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3."}, {"lang": "es", "value": "Cursor es un editor de c\u00f3digo creado para programar con IA. En versiones anteriores a la 1.3, un atacante puede omitir la lista de permitidos en modo de ejecuci\u00f3n autom\u00e1tica con un acento grave (`) o $(cmd). Si un usuario ha configurado Cursor de su configuraci\u00f3n predeterminada (que requiere aprobaci\u00f3n para cada llamada de terminal) a una lista de permitidos, un atacante puede ejecutar comandos arbitrarios fuera de la lista de permitidos sin la aprobaci\u00f3n del usuario. Un atacante puede activar esta vulnerabilidad si se combina con la inyecci\u00f3n indirecta de prompts. Esto se corrige en la versi\u00f3n 1.3."}], "lastModified": "2025-08-25T01:53:54.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CC3BD06-C788-4AE8-80B9-8CF608AB5F5F", "versionEndExcluding": "1.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}