https://vulnerability.circl.lu/sightings/feed 2026-06-03T04:47:38.977265+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9f6a6b26-ad18-4820-9997-1889a9d37c1e/export 2026-06-03T04:47:39.340451+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9f6a6b26-ad18-4820-9997-1889a9d37c1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-48919", "type": "seen", "source": "https://t.me/cvedetector/8648", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-48919 - \"Cursor Terminal Cmd-K Web Page Code Injection Vulnerability\"\", \n \"Content\": \"CVE ID : CVE-2024-48919 \nPublished : Oct. 22, 2024, 9:15 p.m. | 30\u00a0minutes ago \nDescription : Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature and if the user explicitly imported a malicious web page into the Terminal Cmd-K prompt, an attacker with control over the referenced web page could have a significant chance of influencing a language model to output arbitrary commands for execution in the user's terminal. This scenario would require the user explicitly opt-in to including the contents of a compromised webpage, and it would require that the attacker display prompt injection text in the the contents of the compromised webpage. \n \nA server-side patch to not stream back newlines or control characters was released on September 27, 2024, within two hours of the issue being reported. Additionally, Cursor 0.42 includes client-side mitigations to prevent any newline or control character from being streamed into the terminal directly. It also contains a new setting, `\"cursor.terminal.usePreviewBox\"`, which, if set to true, streams the response into a preview box whose contents then have to be manually accepted before being inserted into the terminal. This setting is useful if you're working in a shell environment where commands can be executed without pressing enter or any control character. The patch has been applied server-side, so no additional action is needed, even on older versions of Cursor. Separately, Cursor's maintainers also recommend, as best practice, to only include trusted pieces of context in prompts. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"22 Oct 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-22T23:49:34.000000Z"} 2024-10-22T23:49:34+00:00