PT-2025-40536 · Cursor · Cursor

Y4Tacker · Published 2025-10-03 · Updated 2025-10-10 · CVE-2025-61591

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7 and earlier

Description Cursor, a code editor for programming with AI, has an issue where, when using OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious server and inject commands. This can lead to command injection and potential remote code execution. If combined with an untrusted MCP service via OAuth, this could allow arbitrary code execution on the host with full user privileges. The vulnerable process involves interaction during OAuth authentication, where crafted commands are returned by the malicious server. The API endpoint used for OAuth authentication is susceptible to manipulation. The MCP server is involved in the authentication process.

Recommendations Apply patch 2025.09.17-25b418f.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-61591

GHSA-WJ33-264C-J9CQ

Affected Products

Cursor

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61591.json · Exploit
• https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61591 · Security Note
• https://twitter.com/german_retamosa/status/1976753098308845870 · Twitter Post
• https://twitter.com/CVEnew/status/1974156097620746400 · Twitter Post
• https://twitter.com/CveFindCom/status/1974160398229123113 · Twitter Post