PT-2025-48141 · Cursor · Cursor

Published 2025-11-26 · Updated 2025-12-01 · CVE-2025-62354

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor (affected versions not specified)

Description An improper neutralization of special elements used in an OS command ('command injection') exists in Cursor. This allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, potentially leading to arbitrary code execution. The issue is described as a critical risk, with a CVSS score of 9.8. The vulnerability bypasses the allowlist entirely, enabling remote code execution without user interaction. The issue is present when Cursor is in autorun mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-62354

Affected Products

Cursor

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-62354 · Security Note
• https://twitter.com/SecAideInfo/status/1994711623186223192 · Twitter Post
• https://twitter.com/CCBalert/status/1994092917804200391 · Twitter Post
• https://hiddenlayer.com/sai_security_advisor/2025-11-cursor · Note
• https://t.me/CVEtracker/38289 · Telegram Post
• https://twitter.com/CVEnew/status/1993709262111965287 · Twitter Post
• https://twitter.com/cracbot/status/1995447853293179002 · Twitter Post
• https://twitter.com/0dayPublishing/status/1993710102679875605 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1993749274186703006 · Twitter Post
• https://twitter.com/vuln_tracker/status/1993727070585688490 · Twitter Post
• https://twitter.com/CveFindCom/status/1993736451863842929 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993721935541244266 · Twitter Post