CVE-2025-62354
Published: 26 November 2025
Description
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of information inputs to OS commands, directly preventing improper neutralization of special elements that enable command injection.
Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability through patching and updates.
Restricts system functionality to only essential capabilities, limiting the impact of arbitrary command execution by prohibiting unnecessary OS commands outside the intended allowlist.
Security SummaryAI
CVE-2025-62354 is a critical command injection vulnerability (CWE-78) in Cursor, stemming from improper neutralization of special elements used in an OS command. This flaw allows an unauthorized attacker to execute commands outside of those specified in the allowlist, resulting in arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-11-26.
Any unauthorized attacker can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction. Successful exploitation enables full arbitrary code execution on the affected system, potentially compromising confidentiality, integrity, and availability.
Mitigation details are available in the advisory published by HiddenLayer at https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability enabling remote unauthenticated arbitrary OS command execution (AV:N/AC:L/PR:N), directly mapping to exploitation of a public-facing application.