CVE-2025-54131: Anysphere Cursor RCE Vulnerability

CVE-2025-54131 Overview

CVE-2025-54131 is a command injection vulnerability in Cursor, an AI-powered code editor developed by Anysphere. The flaw allows attackers to bypass the auto-run allowlist using backtick (`) or $(cmd) shell substitution syntax. When users configure Cursor to use an allowlist instead of the default per-command approval, attackers can execute arbitrary commands outside that allowlist without user consent. The vulnerability becomes exploitable when chained with indirect prompt injection, where malicious instructions are embedded in content the AI agent processes. The issue is fixed in Cursor version 1.3.

Critical Impact

Attackers can achieve arbitrary command execution on developer workstations by chaining indirect prompt injection with allowlist bypass, leading to source code theft, credential exfiltration, or supply chain compromise.

Affected Products

• Anysphere Cursor versions prior to 1.3
• Cursor installations configured with command allowlist mode
• Cursor auto-run mode for terminal commands

Discovery Timeline

• 2025-08-01 - CVE-2025-54131 published to NVD
• 2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-54131

Vulnerability Analysis

The vulnerability is classified as Command Injection [CWE-77]. Cursor's auto-run feature lets the AI agent execute terminal commands automatically. Users can opt into an allowlist mode that approves specific commands without prompting. The allowlist matcher inspects the command string but fails to account for shell metacharacters that trigger command substitution.

An attacker who controls input the AI processes can craft commands such as ls `malicious-cmd` or ls $(malicious-cmd). The outer command matches the allowlist, while the shell evaluates the inner substitution before execution. This grants arbitrary command execution under the user's account.

The attack becomes practical through indirect prompt injection. Malicious instructions hidden in repositories, documentation, web pages, or other content the agent reads can steer the AI into running crafted commands.

Root Cause

The root cause is incomplete neutralization of special elements in commands evaluated against the allowlist. The matcher treats the command string as opaque text rather than parsing shell syntax. Backtick and $() substitutions are not stripped, rejected, or evaluated before allowlist comparison.

Attack Vector

Exploitation requires the user to have switched Cursor from default per-call approval to allowlist mode. The attacker plants prompt injection payloads in content the agent ingests. The agent constructs a terminal command containing shell substitution that the allowlist permits at face value. The shell then executes the attacker's embedded payload with the developer's privileges.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-534m-3w6r-8pqr. No verified public proof-of-concept code is available.

Detection Methods for CVE-2025-54131

Indicators of Compromise

• Terminal command history containing backtick or $() substitution patterns issued by the Cursor agent process
• Unexpected child processes spawned from Cursor or its integrated terminal
• Outbound network connections from developer endpoints to unfamiliar hosts shortly after AI agent activity
• Reads of sensitive files such as ~/.ssh/, ~/.aws/credentials, or .env by Cursor child processes

Detection Strategies

• Monitor process trees where Cursor spawns shells executing commands containing ` or $( metacharacters
• Correlate AI agent prompts with executed shell commands to identify substitution patterns the allowlist should have blocked
• Audit Cursor configuration files to identify endpoints running in allowlist mode and assess exposure
• Flag agent-initiated commands that access credential stores, package registries, or git remotes

Monitoring Recommendations

• Enable shell command auditing (auditd on Linux, PowerShell ScriptBlockLogging on Windows) on developer workstations
• Forward endpoint process telemetry to a centralized analytics platform for behavioral analysis
• Alert on Cursor processes executing outside expected directories or contacting non-corporate domains
• Review repositories and documentation pulled into AI context for embedded instructions targeting terminal execution

How to Mitigate CVE-2025-54131

Immediate Actions Required

• Upgrade Cursor to version 1.3 or later on all developer workstations
• Revert to the default setting requiring approval for every terminal command until the upgrade is verified
• Inventory endpoints that enabled allowlist mode and prioritize patching those systems first
• Rotate any credentials, tokens, or SSH keys accessible from workstations that ran vulnerable Cursor versions in allowlist mode

Patch Information

Anysphere addressed the vulnerability in Cursor 1.3. The fix updates the allowlist matcher to properly handle shell metacharacters that enable command substitution. Refer to the Cursor Security Advisory GHSA-534m-3w6r-8pqr for vendor guidance.

Workarounds

• Disable auto-run mode entirely and require manual approval for every terminal command issued by the AI agent
• Restrict the AI agent to ingesting only trusted repositories and documentation to limit indirect prompt injection exposure
• Run Cursor inside a sandboxed environment or dedicated virtual machine with no access to production credentials
• Apply least-privilege principles on developer accounts to constrain the impact of arbitrary command execution

# Configuration example: disable allowlist mode and require approval for every command
# In Cursor settings.json
{
  "cursor.terminal.autoRun": false,
  "cursor.terminal.allowlist": [],
  "cursor.terminal.requireApproval": "always"
}