Code Editor Vulnerability in Cursor Affects Programming with AI
CVE-2025-54130

7.5HIGH

Key Information:

Vendor

Cursor

Status
Cursor
Vendor
CVE Published:
5 August 2025

What is CVE-2025-54130?

The Cursor code editor, designed for AI-assisted programming, has a vulnerability that allows attackers to create or modify workspace files without user consent in versions prior to 1.3.9. Dotfiles, which require explicit permission to edit, can be manipulated due to this flaw. If critical files such as the .vscode/settings.json file do not exist, an attacker may exploit an indirect prompt injection vulnerability, potentially leading to remote code execution (RCE) on the victim's system without any approval from the user. This issue is addressed in version 1.3.9.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

cursor < 1.3.9

References

https://github.com/cursor/cursor/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.