What is CVE-2025-54130?

CVE-2025-54130 is a high-severity vulnerability in Anysphere Cursor, classified under Improper Authorization. CVSS score: 7.5/10. Published 2025-08-05.

How severe is CVE-2025-54130?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Anysphere Cursor

CVE-2025-54130

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence…

EPSS: 0.003 (16.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Anysphere Cursor
Cursor — versions < 1.3.9

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2025-54130?: CVE-2025-54130 is a high-severity vulnerability in Anysphere Cursor, classified under Improper Authorization. CVSS score: 7.5/10. Published 2025-08-05.
How severe is CVE-2025-54130?: High severity. CVSS v3 base score is 7.5 out of 10.