---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: Prior to 3.0
---END_METADATA---

Description Summary:
A sandbox escape vulnerability in the Cursor AI code editor allows malicious agents to write arbitrary files outside the workspace, leading to non-sandboxed Remote Code Execution.

Executive Summary:
The Cursor AI code editor is vulnerable to a sandbox escape that permits arbitrary file writes and Remote Code Execution under the user's privileges.

Vulnerability Details

CVE-ID: CVE-2026-50548

Affected Software: Cursor Cursor

Affected Versions: Prior to 3.0

Vulnerability: This is a sandbox escape vulnerability where the agent's working_directory parameter is improperly validated, allowing the agent to break out of the restricted sandbox environment. The vulnerability is exploitable by a malicious AI agent without further user interaction beyond an initial prompt.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the full privileges of the user running the Cursor editor. Given the CVSS score of 9.3, the impact is critical, as it facilitates complete system compromise, potential lateral movement within the development environment, and the exfiltration of sensitive source code or credentials.

Remediation Plan

Immediate Action: Upgrade the Cursor application to version 3.0 or later immediately to apply the necessary sandbox boundary constraints.

Proactive Monitoring: Monitor terminal output and file system logs for unexpected write operations occurring outside of established project directories.

Compensating Controls: Limit the permissions of the user account running the Cursor application to the minimum necessary to perform development tasks to reduce the impact of a potential sandbox breakout.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of development environments. Users and organizations utilizing Cursor should prioritize upgrading to version 3.0 immediately to remediate the sandbox escape flaw and prevent unauthorized remote code execution.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor CLI
AFFECTED_VERSIONS: < 2025.09.17-25b418f
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-4hwr-97q3-37w2","name":"https://github.com/cursor/cursor/security/advisories/GHSA-4hwr-97q3-37w2","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.130Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Cursor CLI allows unauthenticated attackers to achieve remote code execution by tricking a user into cloning a repository containing a malicious MCP configuration.

Executive Summary:
A critical remote code execution vulnerability in the Cursor CLI allows attackers to execute arbitrary commands on a victim's machine by leveraging the Model Context Protocol (MCP) server mechanism.

Vulnerability Details

CVE-ID: CVE-2025-64109

Affected Software: Cursor CLI

Affected Versions: < 2025.09.17-25b418f

Vulnerability: This is an OS command injection flaw (CWE-78) where the application fails to safely handle configurations defined in the .cursor/mcp.json file. An unauthenticated attacker can craft a malicious configuration file that executes arbitrary system commands immediately upon the user opening the repository in the Cursor editor.

Business Impact

Successful exploitation of this vulnerability leads to full remote code execution on the developer's workstation. Given the CVSS score of 8.8, this represents a high-severity risk that could result in the compromise of sensitive credentials, source code theft, or the deployment of persistent backdoors within the development environment.

Remediation Plan

Immediate Action: Update the Cursor application to version 2025.09.17-25b418f or later immediately to incorporate the patch for the MCP configuration parser.

Proactive Monitoring: Security teams should audit developer environments for suspicious file modifications within the .cursor directory of cloned repositories.

Compensating Controls: Advise developers to exercise extreme caution when cloning or opening untrusted repositories from unknown sources until the software update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 6, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the trust model associated with IDE configuration files, which often execute with the privileges of the local user.

Analyst Recommendation

This vulnerability poses a significant risk to development organizations by turning a common workflow, such as cloning a repository, into an attack vector. Organizations must prioritize the update of all Cursor installations to the patched version across all developer workstations to prevent potential system compromise and lateral movement within the corporate network.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor CLI Agent
AFFECTED_VERSIONS: <= 1.7
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6","name":"https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.402Z
---END_METADATA---

Description Summary:
A vulnerability in the Cursor CLI Agent allows attackers to achieve remote code execution via prompt injection by modifying sensitive configuration files on case-insensitive filesystems.

Executive Summary:
A critical vulnerability in the Cursor CLI Agent enables remote code execution for authenticated users through prompt injection attacks.

Vulnerability Details

CVE-ID: CVE-2025-61593

Affected Software: Cursor CLI Agent

Affected Versions: <= 1.7

Vulnerability: The vulnerability arises from improper handling of case sensitivity and improper control of generated code, which allows prompt injection to modify sensitive files such as .cursor/cli.json. This flaw requires the attacker to have low privileges and user interaction to successfully execute arbitrary commands.

Business Impact

The ability for an attacker to achieve remote code execution poses a severe risk to the integrity and confidentiality of the development environment. Successful exploitation could lead to full system compromise, unauthorized access to source code, and the exfiltration of sensitive credentials stored within the development workspace. The CVSS score of 7.1 highlights a high risk, particularly in environments where AI-assisted tools are granted broad system access.

Remediation Plan

Immediate Action: As a formal release containing the fix (commit 25b418f) is not yet available, users should restrict the use of the Cursor CLI Agent in untrusted environments and avoid processing suspicious AI prompts that may attempt to modify local configuration files.

Proactive Monitoring: Security teams should audit file integrity for the .cursor directory and monitor for unauthorized modifications to the cli.json configuration file.

Compensating Controls: Implement strict file system permissions to prevent the CLI agent from writing to sensitive system paths and utilize sandbox environments to isolate AI-assisted coding activities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bridge prompt injection into arbitrary code execution on host systems.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant security risk to development workflows. Users are advised to monitor the official Cursor security advisory for the release of a patched version. Until a fix is deployed, enforce strict operational security practices when interacting with AI prompts to prevent potential exploitation.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor CLI
AFFECTED_VERSIONS: <= 1.7
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-v64q-396f-7m79","name":"https://github.com/cursor/cursor/security/advisories/GHSA-v64q-396f-7m79","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.402Z
---END_METADATA---

Description Summary:
A vulnerability in the Cursor code editor allows remote code execution when a user initializes the CLI within a malicious repository, due to unsafe loading of project-specific configurations.

Executive Summary:
A critical vulnerability in the Cursor code editor allows unauthenticated attackers to achieve remote code execution by tricking users into running the CLI within a malicious project directory.

Vulnerability Details

CVE-ID: CVE-2025-61592

Affected Software: Cursor Cursor CLI

Affected Versions: <= 1.7

Vulnerability: The application suffers from the inclusion of functionality from an untrusted control sphere, where automatic loading of configuration files from the current working directory overrides global settings. This enables remote code execution through the manipulation of project-specific CLI configurations and prompt injection.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the user running the Cursor CLI. Given the CVSS score of 8.8, this presents a significant risk of full system compromise, data exfiltration, and lateral movement within the developer's environment. The potential for reputational damage and the loss of intellectual property through compromised source code repositories is substantial.

Remediation Plan

Immediate Action: Apply the vendor-provided patch version 2025.09.17-25b418f immediately to remediate the unsafe configuration loading mechanism.

Proactive Monitoring: Review developer workstation access logs and monitor for unexpected CLI execution patterns or unauthorized modifications to local .cursor/ directory contents.

Compensating Controls: Advise developers to avoid running Cursor CLI commands in untrusted or unknown project directories until the patch has been applied to their environment.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous because it targets the trust developers place in local project configuration files, making it a high-risk vector for supply chain or repository-based attacks.

Analyst Recommendation

The severity of this remote code execution vulnerability necessitates immediate action, particularly for organizations that handle sensitive source code. Developers must prioritize the application of the specified patch version to ensure that project-specific configurations cannot be used to hijack the Cursor CLI environment. Failure to remediate this flaw leaves development workstations exposed to potential compromise by malicious repository content.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: <= 1.7
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq","name":"https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.402Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Cursor versions 1.7 and below allows attackers to achieve remote code execution via a malicious MCP server using OAuth authentication.

Executive Summary:
Cursor versions 1.7 and below are susceptible to remote code execution through a command injection vulnerability when interacting with untrusted MCP servers.

Vulnerability Details

CVE-ID: CVE-2025-61591

Affected Software: Cursor

Affected Versions: <= 1.7

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) occurring when the application uses OAuth authentication with an untrusted MCP server. An unauthenticated attacker can impersonate a server to inject and execute arbitrary commands with full user privileges on the host system.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on the host machine, leading to a full system compromise. Given the CVSS score of 8.8, this vulnerability poses a severe risk to development environments, potentially exposing proprietary source code, secrets, and credentials stored within the developer workstation.

Remediation Plan

Immediate Action: Apply the available patch, 2025.09.17-25b418f, provided by the vendor to remediate the command injection flaw.

Proactive Monitoring: Monitor system logs for unexpected child processes spawned by the Cursor editor or unusual network connections initiated to unknown MCP servers.

Compensating Controls: Avoid connecting the editor to untrusted or unverified MCP servers until the patch is applied, and ensure the development environment is isolated from sensitive production networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous as it allows for remote code execution with the full privileges of the user running the editor.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention due to the potential for full system compromise. Users and IT administrators should prioritize applying the vendor provided patch, 2025.09.17-25b418f, as soon as possible to mitigate the risk of arbitrary command execution.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: < 1.7
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r","name":"https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.402Z
---END_METADATA---

Description Summary:
Cursor code editor versions 1.6 and below are vulnerable to Remote Code Execution via malicious manipulation of VS Code workspace settings.

Executive Summary:
A critical vulnerability in the Cursor code editor allows authenticated attackers to achieve Remote Code Execution by injecting malicious workspace configurations.

Vulnerability Details

CVE-ID: CVE-2025-61590

Affected Software: Cursor

Affected Versions: < 1.7

Vulnerability: This vulnerability involves improper control of code generation (CWE-94) where an attacker who compromises the chat context, such as through a malicious MCP server, can use prompt injection to modify workspace files. This action bypasses existing security controls and allows for the execution of arbitrary code within the user environment.

Business Impact

The ability for an attacker to execute arbitrary code on a developer machine presents a severe risk to organizational intellectual property and production environments. A successful exploit could lead to the theft of source code, the insertion of backdoors into software projects, or unauthorized access to cloud infrastructure credentials stored locally. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to prevent lateral movement within the software development lifecycle.

Remediation Plan

Immediate Action: Update the Cursor application to version 1.7 or higher immediately to apply the necessary security fixes.

Proactive Monitoring: Monitor developer workstation logs for unusual file modifications, particularly changes to .code-workspace files or unexpected outbound network connections initiated by the editor.

Compensating Controls: Exercise caution when interacting with untrusted AI agents or third-party MCP servers, as these represent the primary attack vector for this vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires a specific sequence of events, including the compromise of the chat context, to achieve execution.

Analyst Recommendation

The severity of this vulnerability necessitates a swift response from security teams and individual developers. Organizations should enforce a mandatory update policy for all instances of the Cursor editor to version 1.7 or later. By ensuring the software is patched, teams effectively neutralize the primary vector for this remote code execution flaw and protect their development environments from potential compromise.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor IDE
AFFECTED_VERSIONS: 1.6.23 and below
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-xcwh-rrwj-gxc7","name":"https://github.com/cursor/cursor/security/advisories/GHSA-xcwh-rrwj-gxc7","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.414Z
---END_METADATA---

Description Summary:
Cursor IDE contains a case-sensitivity vulnerability in file protection mechanisms, allowing attackers to modify sensitive files and achieve remote code execution via prompt injection.

Executive Summary:
A critical vulnerability in Cursor IDE allows authenticated attackers to achieve remote code execution through prompt injection on systems with case-insensitive file systems.

Vulnerability Details

CVE-ID: CVE-2025-59944

Affected Software: Cursor Cursor IDE

Affected Versions: 1.6.23 and below

Vulnerability: The application improperly handles case sensitivity when protecting sensitive configuration files, such as mcp.json. An attacker with low-level privileges can leverage prompt injection to modify these files and execute arbitrary code on the underlying system.

Business Impact

The ability to achieve remote code execution poses a severe threat to organizational security, as it grants attackers full control over the affected developer workstation. This could lead to the theft of proprietary source code, access to internal credentials, or the injection of malicious code into development pipelines. Given the CVSS score of 8.0, this is classified as a high-severity risk that requires immediate attention to prevent lateral movement within the development environment.

Remediation Plan

Immediate Action: Update the Cursor IDE to version 1.7 or later, which contains the fix for this case-sensitivity flaw.

Proactive Monitoring: Review audit logs for unusual file modification patterns within the .cursor directory and monitor for suspicious AI prompt inputs that deviate from standard development workflows.

Compensating Controls: Ensure that developer machines are configured with strict file system permissions and consider using endpoint detection and response tools to monitor for unauthorized execution of child processes initiated by the IDE.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on the specific behavior of case-insensitive file systems and the interaction between the AI assistant and local file protections.

Analyst Recommendation

This vulnerability represents a significant risk to development environments due to the potential for full remote code execution. Security teams should prioritize updating all instances of Cursor IDE to version 1.7 or higher across the organization. Failure to patch may allow attackers to gain persistent access to sensitive development infrastructure and proprietary intellectual property.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: < 1.3.9
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm","name":"https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.710Z
---END_METADATA---

Description Summary:
A vulnerability in the Cursor code editor allows attackers to write files without user approval, enabling remote code execution via indirect prompt injection and malicious configuration file creation.

Executive Summary:
A critical vulnerability in Cursor versions prior to 1.3.9 permits unauthorized file manipulation and potential remote code execution, posing a significant risk to development environments.

Vulnerability Details

CVE-ID: CVE-2025-54135

Affected Software: Cursor

Affected Versions: < 1.3.9

Vulnerability: This issue involves improper neutralization of special elements and inclusion of functionality from untrusted control spheres, allowing a low-privileged attacker to write to sensitive workspace files and execute arbitrary commands. The exploit chain leverages indirect prompt injection to hijack the editor context and create or modify system files without explicit user consent.

Business Impact

The ability for an unauthenticated or low-privileged attacker to achieve remote code execution on a developer workstation presents a severe risk to intellectual property and organizational integrity. Given the CVSS score of 8.5, this flaw could lead to full system compromise, the exfiltration of sensitive source code, or the injection of malicious backdoors into software projects.

Remediation Plan

Immediate Action: Update the Cursor application to version 1.3.9 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review workspace configuration files, particularly those located in the .cursor directory, for unauthorized modifications or unexpected additions.

Compensating Controls: Restrict the execution of AI-based coding tools within high-security or production-critical environments until updates are verified, and maintain robust endpoint detection and response (EDR) solutions to identify suspicious child processes spawned by the editor.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in GitHub repositories.

Analyst Notes: As of August 5, 2025, there is no confirmed active exploitation in the wild; however, because public proof-of-concept code is available, the risk of exploitation is credible and should be addressed as a priority. The flaw is inherently dangerous because it bypasses the standard interaction model designed to protect user workspaces from malicious AI-driven actions.

Analyst Recommendation

This vulnerability represents a high-severity threat to any organization utilizing Cursor for software development. The combination of remote code execution potential and the existence of public proof-of-concept material necessitates an immediate upgrade to version 1.3.9. Security teams should prioritize this patch across all developer workstations to prevent potential supply chain or internal system compromise.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: < 1.3.9
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f","name":"https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.714Z
---END_METADATA---

Description Summary:
A vulnerability in the Cursor code editor allows unauthorized file writes, enabling attackers to perform remote code execution via malicious workspace configurations.

Executive Summary:
Cursor versions prior to 1.3.9 contain an improper authorization flaw that permits attackers to execute arbitrary code on a victim machine without user approval.

Vulnerability Details

CVE-ID: CVE-2025-54130

Affected Software: Cursor

Affected Versions: < 1.3.9

Vulnerability: This vulnerability, classified as improper authorization (CWE-285), allows an attacker to write files into a workspace without user consent. By chaining this with indirect prompt injection, an attacker can manipulate sensitive configuration files such as .vscode/settings.json to achieve remote code execution.

Business Impact

The ability to achieve remote code execution poses a severe risk to organizational security, as it grants attackers full control over the affected development environment. With a CVSS score of 7.5, this vulnerability could lead to the theft of intellectual property, credential harvesting, or the lateral movement of threats within the corporate network.

Remediation Plan

Immediate Action: Update the Cursor editor to version 1.3.9 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Monitor developer workstations for unusual file system modifications, particularly the creation or modification of hidden configuration files in workspace directories.

Compensating Controls: Ensure that developers execute untrusted code or projects within isolated environments or containers to minimize the impact of potential RCE attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires a specific sequence of actions to trigger, specifically the absence of existing configuration files in a workspace, which limits the immediate attack surface.

Analyst Recommendation

Given the high impact of remote code execution, organizations using Cursor should prioritize patching this vulnerability across all development endpoints. Promptly updating to version 1.3.9 is the only definitive method to eliminate the authorization bypass and prevent attackers from weaponizing workspace configurations.