Remote Code Execution in Cursor Code Editor for Windows by Cursor

CVE-2025-64107

What is CVE-2025-64107?

In the Cursor Code Editor, versions up to 1.7.52 are vulnerable to remote code execution due to improper detection of path manipulation using backslashes. While the editor correctly identifies attacks using forward slashes, it fails to apply the same scrutiny to backslashes, enabling potential attackers with existing control over the system to overwrite sensitive files without user approval. This security flaw is particularly concerning for Windows users and has been addressed in the subsequent version 2.0.

References