Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M

CVE-2025-54131Cursor bypasses its allow list to execute arbitrary commands

Medium 6.4

In plain English

A medium-severity command injection in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.5%top 54.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3.

Affected products (as reported)

Vendor	Product	Versions
cursor	cursor	< 1.3

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr x_refsource_CONFIRM