Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31854Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass

High 8.7

In plain English

A high-severity OS command injection in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, thereby posing a significant security risk. This vulnerability is fixed in 2.0.

Affected products (as reported)

Vendor	Product	Versions
cursor	cursor	< 2.0

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/cursor/cursor/security/advisories/GHSA-hf2x-r83r-qw5q x_refsource_CONFIRM