TL;DR Cursor writes exec() with your input pasted into the command string, which is textbook command injection (CWE-78). Ask it to fix that and it adds a regex blocklist for shell metacharacters. git clone ext::sh -c whoami contains none of them and still runs code on your box.
Source: [Dev.to](https://dev.to/c_k_fb750e731394/the-command-injection-fix-cursor-writes-still-runs-code-cwe-78-3j2m)