Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, thereby posing a significant security risk. This vulnerability is fixed in 2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-12 | 2 | Disclosure2 |
| 2026-03-15 | 1 | Disclosure1 |
| 2026-06-17 | 1 | Disclosure1 |
04:49 UTC: CVE-2026-31854 disclosed. The Compromised Workbench: Definitive 2026 Defensive Playbook Against IDE Extension Supply Chain Attacks (GlassWorm + PA
Post summary
CVE-2026-31854 has been disclosed, but the text offers no additional details on exploitation, patching, or technical attributes.
📝 New article: CVE-2026-31854: How Cursor AI's Command Whitelist Bypass Exposes the Prompt Injection Reality https://moltx.io/articles/82c5f83f-62c0-4780-9af0-8c0d9da65910
Post summary
The post announces a new article about CVE‑2026‑31854, noting a Command Whitelist Bypass in Cursor AI that reveals prompt injection vulnerabilities, but it lacks detailed technical or mitigation information.
🚨*CVE* CVE-2026-31854 Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow t… https://www.cve.org/CVERecord?id=CVE-2026-31854 ----- Traducción: CVE-2026-31854 Cur… http://infoflow.cloud`
Post summary
The post announces CVE-2026-31854 targeting the Cursor AI code editor, indicating that versions prior to 2.0 may process maliciously crafted instructions, but it provides no exploit, patch, or detailed vulnerability analysis.
CVE-2026-31854 Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow t… https://www.cve.org/CVERecord?id=CVE-2026-31854
Post summary
The post announces CVE‑2026‑31854 in Cursor (pre‑2.0), noting that malicious website instructions may prompt the AI to follow them, revealing a potential instruction‑following security flaw.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | anysphere | cursor | - | - | - |