CVE-2026-31854: 
NixOS vulnerability analysis and mitigation

CVE-2026-31854 is an indirect prompt injection vulnerability in the Cursor AI code editor (by Anysphere) that enables arbitrary OS command execution via a bypass of the command whitelist mechanism. Affecting all versions prior to 2.0 (including the latest 1.4.5 at time of disclosure), the vulnerability was published on March 11, 2026, and fixed in version 2.0. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), arising from Cursor's ability to access arbitrary websites and pass their content to an AI model without adequate sanitization (GitHub Advisory). When a user visits a maliciously crafted website through the Cursor Agent, embedded prompt-injection instructions can manipulate the AI model into treating attacker-controlled text as legitimate user commands. Critically, this attack also exploits a bypass of Cursor's command whitelist mechanism — the "Use AllowList" setting in Auto-Run Mode — meaning even users who believed they had restricted command execution were vulnerable. No special privileges are required from the attacker; only passive user interaction (visiting the malicious site) is needed (GitHub Advisory).

Successful exploitation allows an attacker to achieve arbitrary OS command execution on the victim's system through the Cursor Agent, without the user's knowledge or consent. This results in high confidentiality, integrity, and availability impact — attackers could exfiltrate sensitive data (source code, credentials, environment variables), modify or delete files, install malware, or pivot to other systems on the local network. Any Cursor user who interacts with untrusted websites while using the Cursor Agent is at risk, regardless of their Auto-Run Mode configuration (GitHub Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.047%, reflecting a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher Y4tacker (GitHub Advisory).

1. Craft a malicious website: The attacker creates a webpage containing hidden or visible text with prompt-injection instructions designed to be interpreted by the Cursor AI model as legitimate user commands (e.g., instructions embedded in HTML comments, invisible text, or page content).
2. Lure the victim: The attacker induces a Cursor user to visit the malicious website through the Cursor Agent (e.g., via a phishing link, a compromised dependency documentation page, or a malicious search result).
3. Trigger prompt injection: When Cursor's AI model processes the page content to "assist" the user, it reads and follows the attacker-embedded instructions, treating them as user intent.
4. Bypass the command whitelist: The injected instructions exploit a flaw in the whitelist validation logic to include commands that would normally be blocked by the "Use AllowList" Auto-Run Mode setting, circumventing the intended security control.
5. Execute arbitrary OS commands: The AI model automatically executes the attacker-specified OS commands on the victim's system without prompting the user for confirmation, achieving arbitrary code execution (GitHub Advisory).

• Process: Unexpected child processes spawned by the Cursor Agent process (e.g., sh, bash, cmd.exe, powershell.exe, curl, wget) that were not explicitly initiated by the user.
• Network: Outbound network connections from the Cursor process to unusual or unexpected external IP addresses or domains, particularly following visits to unfamiliar websites.
• File System: Unexpected new files, scripts, or executables created in user home directories, temp directories, or project folders; unauthorized modifications to existing files or configuration.
• Logs: Cursor Agent logs showing command execution events that do not correspond to user-initiated actions; commands referencing external URLs or encoded payloads in the Cursor activity log.

The vulnerability is fixed in Cursor version 2.0; users should upgrade immediately (GitHub Advisory). Until patching is possible, users should avoid visiting untrusted or suspicious websites while using the Cursor Agent, and consider disabling Auto-Run Mode entirely or restricting network access during development sessions. Implementing network-level controls to limit which websites can be accessed through Cursor provides an additional layer of defense (Feedly).

The vulnerability was disclosed via GitHub Security Advisories by researcher Y4tacker and received automated coverage from CVE tracking services and security feeds shortly after publication (GitHub Advisory). No significant vendor statements beyond the advisory, notable researcher commentary, or major media coverage have been identified at this time.