CVE-2025-54135OS Command Injection in Cursor

Severity
9.8CRITICALNVD
EPSS
0.1%
top 74.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 5
Latest updateNov 21

Description

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

CVEListV5cursor/cursor< 1.3.9
NVDanysphere/cursor< 1.3.9

🕵️Threat Intelligence

7
Tenable
Cybersecurity Snapshot: Global Agencies Target Criminal “Bulletproof” Hosts, as CSA Unveils Agentic AI Risk Framework2025-11-21
Tenable
Cybersecurity Snapshot: Refresh Your Akira Defenses Now, CISA Says, as OWASP Revamps Its App Sec Top 10 Risks2025-11-14
Tenable
Cybersecurity Snapshot: AI Will Take Center Stage in Cyber in 2026, Google Says, as MITRE Revamps ATT&amp;CK Framework2025-11-07
Tenable
Cybersecurity Snapshot: Top Advice for Detecting and Preventing AI Attacks, and for Securing AI Systems2025-10-24
Tenable
Cybersecurity Snapshot: Agentic AI Security in Focus With Anthropic’s Chilling Abuse Disclosure and CSA’s New Identity Protection Framework2025-08-29

📄Research Papers

3
arXiv
TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection2025-10-13
arXiv
"Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors2025-09-26
arXiv
Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE2025-09-19