CVE-2025-54131 Cursor bypasses its allow list to execute arbitrary commands

What is CVE-2025-54131?

CVE-2025-54131 is a medium-severity command injection vulnerability in cursor, published on 1 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3.

Weakness: CWE-77

Which versions are affected by CVE-2025-54131?

It affects 1 product.

Products include Anysphere Cursor.

How do I fix CVE-2025-54131?

No fix has been published for CVE-2025-54131 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-54131 being exploited?

There is no known exploitation of CVE-2025-54131 in the wild and no public exploit code.

Other vulnerabilities in cursor

• CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory Critical 9.3
• CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization Critical 9.3
• CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link High 8.8
• CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows High 8.8
• CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made