CVE-2024-48919: Cursor Code Editor RCE Vulnerability

CVE-2024-48919 Overview

CVE-2024-48919 is a prompt injection vulnerability in Cursor, an AI-powered code editor. Prior to September 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature and explicitly imported a malicious web page into the Terminal Cmd-K prompt, an attacker with control over the referenced web page could have a significant chance of influencing the language model to output arbitrary commands for execution in the user's terminal.

This vulnerability requires the user to explicitly opt-in to including the contents of a compromised webpage, and it requires that the attacker display prompt injection text in the contents of the compromised webpage. The attack leverages improper input validation (CWE-20) in the AI prompt processing pipeline, allowing malicious content from external sources to manipulate the language model's command generation.

Critical Impact

Attackers could potentially execute arbitrary terminal commands on a user's system by injecting malicious prompts through compromised web pages imported into Cursor's AI-assisted terminal feature.

Affected Products

• Cursor AI Code Editor (versions prior to September 27, 2024 server-side patch)
• Cursor versions prior to 0.42 (client-side mitigations)

Discovery Timeline

• 2024-09-27 - Server-side patch released within two hours of issue being reported
• 2024-10-22 - CVE CVE-2024-48919 published to NVD
• 2024-10-23 - Last updated in NVD database

Technical Details for CVE-2024-48919

Vulnerability Analysis

This vulnerability represents a prompt injection attack vector targeting AI-assisted code editors. The core issue lies in how Cursor's Terminal Cmd-K feature processes external content that users import into their prompts. When a user includes content from a malicious web page, an attacker can embed specially crafted prompt injection text that influences the underlying language model to generate harmful terminal commands.

The attack chain requires user interaction—specifically, the user must manually import external web content into the Terminal Cmd-K prompt. Once imported, the malicious prompt injection text can manipulate the AI model into generating commands that could be automatically streamed into the terminal for execution. The vulnerability is particularly concerning because the streamed response could include newlines or control characters that might cause immediate command execution in certain shell environments without requiring the user to press Enter.

Root Cause

The root cause stems from improper input validation (CWE-20) in the prompt processing pipeline. The system failed to properly sanitize or filter newlines and control characters in the language model's output before streaming it to the terminal. This allowed malicious content embedded in imported web pages to potentially trigger automatic command execution through control character injection.

Attack Vector

The attack requires network access to host a malicious webpage that a user must explicitly import into their Terminal Cmd-K prompt. The attacker embeds prompt injection text designed to manipulate the language model into generating malicious terminal commands. When the AI model processes the combined prompt (user input plus malicious content), it may output commands containing newlines or control characters that could execute immediately in the user's terminal environment.

The attack is particularly effective in shell environments where commands can execute without the user pressing Enter, as control characters streamed directly into the terminal could trigger execution.

Detection Methods for CVE-2024-48919

Indicators of Compromise

• Unusual terminal commands executed without explicit user confirmation
• Imported web content in Cursor prompts containing suspicious prompt injection patterns
• Unexpected network connections or process spawning from Cursor terminal sessions

Detection Strategies

• Monitor for terminal command execution patterns that deviate from typical user behavior
• Review Cursor usage logs for imports of external web content into Terminal Cmd-K prompts
• Inspect network traffic for connections to suspicious or untrusted web pages being imported into the code editor

Monitoring Recommendations

• Enable enhanced logging for AI-assisted command generation features
• Implement network monitoring to detect connections to known malicious domains during Cursor sessions
• Configure endpoint detection to alert on unusual terminal activity patterns associated with AI code editors

How to Mitigate CVE-2024-48919

Immediate Actions Required

• Verify that the server-side patch (deployed September 27, 2024) is active—no user action required as this was applied server-side
• Update Cursor to version 0.42 or later to benefit from client-side mitigations
• Enable the "cursor.terminal.usePreviewBox" setting if working in shell environments where commands can execute without pressing Enter
• Only include trusted pieces of context in AI prompts as recommended by Cursor's maintainers

Patch Information

A server-side patch was deployed on September 27, 2024, within two hours of the issue being reported. This patch prevents newlines and control characters from being streamed back to clients. Additionally, Cursor version 0.42 includes client-side mitigations that prevent any newline or control character from being streamed into the terminal directly.

The server-side patch has been applied globally, meaning even users on older versions of Cursor are protected. However, updating to version 0.42 or later provides defense-in-depth through client-side protections.

For complete details, refer to the GitHub Security Advisory.

Workarounds

• Enable the "cursor.terminal.usePreviewBox" setting to stream AI responses into a preview box requiring manual acceptance before terminal insertion
• Avoid importing content from untrusted web pages into Terminal Cmd-K prompts
• Review all AI-generated commands before execution, especially when external content has been included in prompts
• Consider restricting network access for the Cursor application to prevent loading of potentially malicious web content

# Enable preview box protection in Cursor settings
# Add to your Cursor settings.json:
{
  "cursor.terminal.usePreviewBox": true
}