CVE-2024-48919
CVSS V2 None
CVSS V3 None
Description
Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature and if the user explicitly imported a malicious web page into the Terminal Cmd-K prompt, an attacker with control over the referenced web page could have a significant chance of influencing a language model to output arbitrary commands for execution in the user's terminal. This scenario would require the user explicitly opt-in to including the contents of a compromised webpage, and it would require that the attacker display prompt injection text in the the contents of the compromised webpage.
A server-side patch to not stream back newlines or control characters was released on September 27, 2024, within two hours of the issue being reported. Additionally, Cursor 0.42 includes client-side mitigations to prevent any newline or control character from being streamed into the terminal directly. It also contains a new setting, `"cursor.terminal.usePreviewBox"`, which, if set to true, streams the response into a preview box whose contents then have to be manually accepted before being inserted into the terminal. This setting is useful if you're working in a shell environment where commands can be executed without pressing enter or any control character. The patch has been applied server-side, so no additional action is needed, even on older versions of Cursor. Separately, Cursor's maintainers also recommend, as best practice, to only include trusted pieces of context in prompts.
Overview
- CVE ID
- CVE-2024-48919
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-10-22T20:58:21.962Z
- Last Modified Date
- 2024-10-22T20:58:21.962Z
Weakness Enumerations
References
Reference URL | Reference Tags |
---|---|
https://github.com/getcursor/cursor/security/advisories/GHSA-rmj9-23rg-gr67 | x_refsource_CONFIRM |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-48919 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-48919 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2024-10-23 13:08:29 | Added to TrackCVE |