LLMHigh
CVE-2026-31854: Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains m…
- Occurred
- Mar 11, 2026
- Published
- Mar 11, 2026
- Source
- NVD CVE
Summary
Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, thereby posing a significant security risk. This vulnerability is fixed in 2.0.
Tags
- CVE
- CVE-2026-31854
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Indirect prompt injection vulnerability in AI-powered code editor allowing unauthorized command execution.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8