Arbitrary code execution Permissive CLI Config in Cursor CLI

Summary

Due to automatic loading of project-specific CLI configuration that affected certain global configurations under the current working directory (<project>/.cursor/cli.json) while using Cursor CLI, users running the CLI inside a malicious repo context are prone to Remote Code Execution via a combination of permissive configuration (allowed shell commands) and prompt injection delivered via project specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms.

Impact

Using Cursor CLI inside a malicious context (repo, directory, etc) could potentially lead to Remote Code Execution on the end-user.

Fix

The project-specific CLI configuration was limited to only non-security settings, removing the allowlist from the vulnerable configurations.

Credit

The vulnerability was discovered by Assaf Levkovich of the JFrog Security Research team.