RCE in Anysphere Cursor
CVE-2025-54135
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.017 (75.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Anysphere Cursor
- Cursor — versions < 1.3.9
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-54135?
- CVE-2025-54135 is a high-severity vulnerability in Anysphere Cursor, classified under OS Command Injection. CVSS score: 8.5/10. Published 2025-08-05.
- How severe is CVE-2025-54135?
- High severity. CVSS v3 base score is 8.5 out of 10.
- Is CVE-2025-54135 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.