Code Editor Vulnerability in Cursor by Cursor Technologies
CVE-2025-59944

8.1HIGH

Key Information:

Vendor

Cursor

Status
Cursor
Vendor
CVE Published:
3 October 2025

What is CVE-2025-59944?

Cursor IDE prior to version 1.7 has a significant vulnerability where case-sensitive checks for sensitive files, such as */.cursor/mcp.json, fail on case-insensitive filesystems. This flaw allows attackers to modify critical file contents using prompt injection techniques, which may subsequently lead to unauthorized remote code execution. Users of Cursor IDE are advised to upgrade to version 1.7 to mitigate this security risk.

Affected Version(s)

cursor < 1.7

References

https://github.com/cursor/cursor/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-59944 : Code Editor Vulnerability in Cursor by Cursor Technologies