PT-2025-45061 · Cursor · Cursor

Published 2025-11-04 · Updated 2025-12-01 · CVE-2025-64107

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.52 and below

Description Cursor, a code editor built for programming with AI, is susceptible to remote code execution (RCE) due to improper handling of path manipulation. The editor correctly detects and requires approval for path manipulation attempts using forward slashes. However, it fails to detect similar manipulation using backslashes on Windows machines. This allows an attacker with existing prompt injection or control to overwrite sensitive editor files without authorization.

Recommendations Update to version 2.0.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-64107

GHSA-2JR2-8WF5-V6PF

Affected Products

Cursor

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64107.json · Exploit
• https://github.com/cursor/cursor/security/advisories/GHSA-2jr2-8wf5-v6pf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64107 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64107 · Vendor Advisory
• https://twitter.com/AnonOzzyDude/status/1988002063725269461 · Twitter Post
• https://t.me/CVEtracker/36572 · Telegram Post
• https://twitter.com/DavidMarquet19/status/1995402590771646740 · Twitter Post
• https://t.me/cveNotify/142328 · Telegram Post