Bypassing allow list to execute an arbitrary command

Summary

An attacker can bypass allow list in auto-run mode with backtick(\) character or $(cmd)`.

Impact

If a user has swapped Cursor from it's default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection.

Remediation

The allowlist logic has switched to a more robust parser.