PT-2024-33268 · Cursor · Cursor

Yuvalo1212 · Published 2024-10-22 · Updated 2024-10-23 · CVE-2024-48919

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Cursor versions prior to 0.42

Description The issue allows an attacker with control over a malicious web page to influence a language model to output arbitrary commands for execution in the user's terminal. This scenario requires the user to explicitly opt-in to including the contents of a compromised webpage and the attacker to display prompt injection text in the contents of the compromised webpage. A server-side patch was released on September 27, 2024, to prevent the streaming of newlines or control characters.

Recommendations For versions prior to 0.42, no additional action is needed as the patch has been applied server-side. For all versions, it is recommended to set the "cursor.terminal.usePreviewBox" setting to true to stream responses into a preview box, which requires manual acceptance before being inserted into the terminal. As a best practice, only include trusted pieces of context in prompts.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-48919

GHSA-RMJ9-23RG-GR67

Affected Products

Cursor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-48919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48919 · Vendor Advisory
• https://github.com/getcursor/cursor/security/advisories/GHSA-rmj9-23rg-gr67 · Note
• https://t.me/cvedetector/8648 · Telegram Post
• https://twitter.com/CVEnew/status/1849046689161888139 · Twitter Post
• https://twitter.com/CveFindCom/status/1848839535423029751 · Twitter Post