A critical vulnerability in the Cursor CLI Agent enables remote code execution for authenticated users through prompt injection attacks.

The vulnerability arises from improper handling of case sensitivity and improper control of generated code, which allows prompt injection to modify sensitive files such as .cursor/cli.json. This flaw requires the attacker to have low privileges and user interaction to successfully execute arbitrary commands.

The ability for an attacker to achieve remote code execution poses a severe risk to the integrity and confidentiality of the development environment. Successful exploitation could lead to full system compromise, unauthorized access to source code, and the exfiltration of sensitive credentials stored within the development workspace. The CVSS score of 7.1 highlights a high risk, particularly in environments where AI-assisted tools are granted broad system access.

Immediate Action: As a formal release containing the fix (commit 25b418f) is not yet available, users should restrict the use of the Cursor CLI Agent in untrusted environments and avoid processing suspicious AI prompts that may attempt to modify local configuration files.

Proactive Monitoring: Security teams should audit file integrity for the .cursor directory and monitor for unauthorized modifications to the cli.json configuration file.

Compensating Controls: Implement strict file system permissions to prevent the CLI agent from writing to sensitive system paths and utilize sandbox environments to isolate AI-assisted coding activities.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a significant security risk to development workflows. Users are advised to monitor the official Cursor security advisory for the release of a patched version. Until a fix is deployed, enforce strict operational security practices when interacting with AI prompts to prevent potential exploitation.