# Cursor Terminal Cmd-K Webpage Prompt Injection to Command Execution

- **Severity:** Medium
- **Signature ID:** `7b3c1f42-9d5e-4a08-b6c1-2f8e5a4d91c7`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

Cursor's Cmd-K/Ctrl-K terminal assistant can generate shell commands based on content it reads from a webpage. If that page contains hidden instructions, Cursor's AI can be tricked into writing and running a dangerous command instead of the one the user asked for. This was fixed by Cursor in September 2024, but the pattern is worth watching for.

## How the attack works

An attacker plants text on a webpage designed to look like an instruction rather than content. A user opens Cmd-K in the Cursor terminal while that page is in context, and the injected text gets pulled into the prompt Cursor uses to generate a shell command. The AI follows the injected instruction instead of the user's actual request, producing a command such as one that downloads a script over plain HTTP and pipes it into an interpreter, decodes and runs encoded data, fetches a file and makes it executable, or reads credential files and sends them out. The rule watches for two separate signals scoped to the Cursor process: a command line with one of these attacker-shaped patterns, or an outgoing web request from Cursor whose body contains both instruction-override language and command-generation markers with an explicit shell directive. It does not try to link the two together into one confirmed chain — it only flags each as suspicious on its own.

## Why it matters

A successful attack can get an attacker-chosen command run on the developer's machine using the credentials and access that user already has, potentially leading to credential theft, malware download, or execution of arbitrary code — all without the user knowingly typing that command.

## What you can do

- Keep Cursor and its terminal integration updated, since this specific chain was patched by the vendor in September 2024.
- Review Cmd-K/Ctrl-K generated commands before letting them execute, especially when a webpage was recently viewed or referenced in context.
- Restrict or monitor outbound plain-HTTP fetches piped into shells, and block traffic to known paste/tunnel services from developer endpoints.
- Treat any AI-generated terminal command containing decode-and-execute, fetch-and-chmod, or credential-file-to-network patterns as suspicious regardless of source.

## Known benign look-alikes

- A detection or security engineer authoring, grepping or testing prompt-injection rules inside the Cursor integrated terminal - mitigated by filter_rule_authoring (Sigma/YAML rule keys, promptfoo/garak/llm-guard markers) and filter_readonly_search (grep/rg/git-grep/less/head style read-only commands).
- Bootstrap installers that legitimately pipe a downloaded script into a shell (rustup, nvm, homebrew, docker convenience script). These are served over HTTPS to a normal domain, so sel_remote_shape (which requires cleartext http:// to a dotted public host, a tunnel/paste service, or URL userinfo credentials) does not match them.
- Local development servers (http://localhost, http://127.0.0.1, RFC1918 hosts) fetched and piped to a shell. sel_remote_shape requires an alphabetic TLD after a dot, so hostless and dotted-quad targets never satisfy it - achieved by narrowing the pattern, not by trusting any host.
- Legitimate developer requests such as "scp my deploy key to the build box" or reading a .env file into a curl call - real, and the reason this branch requires both a credential-shaped path and an egress primitive in the same command line, and the reason the rule is report-only.
- A user pasting security-awareness or red-team documentation that quotes "ignore previous instructions" into the Cmd-K prompt - branch B additionally requires terminal-command-generation markers and an explicit run/execute directive naming a shell primitive, and filter_placeholder suppresses obvious illustrative payloads.
- Cursor telemetry or crash reports echoing a previously blocked command line.

## References

- https://attack.mitre.org/techniques/T1059/
- https://atlas.mitre.org/techniques/AML.T0051
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/cursor-terminal-cmdk-webpage-injection