PT-2025-45062 · Cursor · Cursor

CVE-2025-64108 · Publicado 2025-11-04 · Atualizado 2025-11-10

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.44 and below

Description Cursor, a code editor for programming with AI, has an issue where NTFS path quirks can be exploited by an attacker to bypass file protections and overwrite files that normally require user confirmation. Successful modification of certain protected files could lead to Remote Code Execution (RCE). This requires chaining with a prompt injection or the attachment of a malicious model. The issue only affects systems that support the NTFS file system.

Recommendations Update to version 2.0.

Exploit

Correção

RCE

Path traversal

Code Injection

Enumeração de Fraquezas

CWE-22

CWE-94

Identificadores relacionados

CVE-2025-64108

GHSA-6R98-6QCW-RXRW

Produtos afetados

Cursor

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64108.json · Exploit
• https://github.com/cursor/cursor/security/advisories/GHSA-6r98-6qcw-rxrw · Aviso do Fabricante
• https://t.me/cveNotify/142325 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-64108 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-64108 · Nota de Segurança
• https://t.me/CVEtracker/36573 · Publicação no Telegram