CVE-2025-64110
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In Cursor code editor versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones, allowing a malicious agent to read protected files.
Risk Assessment
Sensitive files (e.g., keys, configuration) from development projects may be leaked if the AI agent is compromised by an attacker.
Recommendation
Update Cursor to version 2.0 or later, which fixes this vulnerability.
Other vulnerabilities in Cursor
See all- CVE-2026-73218High
Cursor IDE for macOS before version 3.0.0 allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read/write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt.
- CVE-2026-73217High
Cursor IDE for macOS before version 3.1.2 allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications.
- CVE-2026-63093High
A binary planting vulnerability in Cursor for Windows version 3.2.16 allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe in the repository root. When a developer clones and opens a crafted repository, Cursor automatically executes the malicious binary without user interaction.
- CVE-2026-61613High
A vulnerability in Cursor editor before 03/31/2026 allowed attacker-controlled web content to connect to an unauthenticated local agent endpoint, enabling code execution in the cloud agent sandbox and access to files, repositories, environment variables, credentials, and GitHub App tokens. The issue was fixed on 03/31/2026 by requiring authentication for the relevant endpoint.
- CVE-2025-64108High
Cursor versions 1.7.44 and below have NTFS path quirks that allow a prompt injection attacker to bypass sensitive file protections and overwrite files requiring human approval. Modification of some protected files can lead to RCE.
- CVE-2025-64107High
In Cursor code editor versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipulation via forward slashes but not via backslashes, allowing an attacker with prompt injection or other control to overwrite sensitive editor files without approval on Windows machines.
- CVE-2025-64106High
In Cursor versions 1.7.28 and below, an input validation flaw in MCP server installation lets crafted deep-links bypass standard security warnings and conceal executed commands from users. If the victim accepts the server, commands specified by the attacker's deep-link are executed.
- CVE-2025-59944High
Cursor IDE versions 1.6.23 and below use case-sensitive checks when protecting sensitive files (e.g., */.cursor/mcp.json), allowing attackers to modify their content via prompt injection. On case-insensitive filesystems this can lead to full remote code execution.
- CVE-2025-61592High
A vulnerability in Cursor code editor versions 1.7 and below. Automatic loading of project-specific CLI configuration (.cursor/cli.json) could override global settings and enable remote code execution through permissive configuration and prompt injection.
- CVE-2025-61591High
Cursor versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, allow an attacker to impersonate a malicious MCP server and return crafted, maliciously injected commands during interaction, leading to command injection and potential remote code execution. This could allow arbitrary code execution on the host by the agent with full user privileges. No fixed release version exists, but patch 2025.09.17-25b418f is available.
Original NVD description (English source)
Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones. This could allow a malicious agent to read protected files. This issue is fixed in version 2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS