PT-2025-45062 · Cursor · Cursor

Published 2025-11-04 · Updated 2025-11-10 · CVE-2025-64108

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.44 and below

Description Cursor, a code editor for programming with AI, has an issue where NTFS path quirks can be exploited by an attacker to bypass file protections and overwrite files that normally require user confirmation. Successful modification of certain protected files could lead to Remote Code Execution (RCE). This requires chaining with a prompt injection or the attachment of a malicious model. The issue only affects systems that support the NTFS file system.

Recommendations Update to version 2.0.

Exploit

Fix

RCE

Path traversal

Code Injection

Weakness Enumeration

CWE-22

CWE-94

Related Identifiers

CVE-2025-64108

GHSA-6R98-6QCW-RXRW

Affected Products

Cursor

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64108.json · Exploit
• https://github.com/cursor/cursor/security/advisories/GHSA-6r98-6qcw-rxrw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64108 · Security Note
• https://t.me/cveNotify/142325 · Telegram Post
• https://t.me/CVEtracker/36573 · Telegram Post