CVE-2026-31854: Cursor command execution via indirect prompt injection from visited websites

Summary

CVE-2026-31854 affects Cursor, a code editor built for programming with AI, in versions prior to 2.0. A visited website containing maliciously crafted instructions can cause the model to follow them, and combined with a bypass of the command whitelist mechanism, commands may be executed automatically without the user's explicit intent. The weakness is classified as CWE-78, OS Command Injection, with a CVSS 4.0 base score of 8.7 (HIGH) assigned by GitHub, Inc.

Mitigation

Fixed in 2.0.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)