CVE-2025-54131
📋 TL;DR
This vulnerability allows attackers to bypass Cursor code editor's allowlist in auto-run mode using backtick (`) or $(cmd) syntax, enabling arbitrary command execution without user approval. Users who have switched from default settings to allowlist mode are affected. The issue can be exploited through indirect prompt injection attacks.
💻 Affected Systems
- Cursor AI Code Editor
📦 What is this software?
Cursor by Anysphere
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary command execution, potentially leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Limited command execution within the user's context, potentially stealing credentials, accessing local files, or installing malware.
If Mitigated
No impact if users maintain default settings requiring approval for every terminal call.
🎯 Exploit Status
Requires chaining with indirect prompt injection and user interaction with malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3 and above
Vendor Advisory: https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr
Restart Required: No
Instructions:
1. Open Cursor editor 2. Go to Settings > About 3. Check for updates or download version 1.3+ from official website 4. Install the update
🔧 Temporary Workarounds
Revert to default security settings
allChange terminal execution settings back to requiring approval for every call instead of using allowlist mode
Disable auto-run mode
allTurn off auto-run functionality entirely to prevent exploitation
🧯 If You Can't Patch
- Revert to default 'require approval for every terminal call' setting
- Disable auto-run mode and only run trusted code manually
- Implement network segmentation to limit potential lateral movement
🔍 How to Verify
Check if Vulnerable:
Check Cursor version in Settings > About. If below 1.3 and using allowlist mode, you are vulnerable.Check Version:
In Cursor: Settings > About shows version numberVerify Fix Applied:
After updating, verify version is 1.3 or higher in Settings > About and test that backtick/$(cmd) commands are properly filtered.📡 Detection & Monitoring
Log Indicators:
- Unexpected terminal commands executed via backtick or $(cmd) syntax
- Commands bypassing allowlist rules
Network Indicators:
- Unusual outbound connections from Cursor process
- Command and control traffic patterns
SIEM Query:
Process execution where command contains backtick or $(cmd) syntax from Cursor process