CVE-2025-59944CWE-178

CVE-2025-59944

High · published October 4, 2025

CVSS v3.1
8.0
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.4th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2025-10-04T01:15Z
Affected products (1)
ProductVersionsFixed in
anysphere/cursor≤ 1.6.23—
References (1)
https://github.com/cursor/cursor/security/advisories/GHSA-xcwh-rrwj-gxc7 · [email protected]
EPSS history
Timeline
  • 03 OCT 20:15Z
    Cursor IDE: Sensitive File Overwrite Bypass is Possible
    cvelistv5