CVE-2025-54130 Cursor Agent is vulnerable prompt injection via Editor Special Files

What is CVE-2025-54130?

CVE-2025-54130 is a high-severity code injection vulnerability in cursor, published on 5 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.

Weakness: CWE-285

Which versions are affected by CVE-2025-54130?

It affects 1 product.

Products include Anysphere Cursor.

How do I fix CVE-2025-54130?

No fix has been published for CVE-2025-54130 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-54130 being exploited?

There is no known exploitation of CVE-2025-54130 in the wild and no public exploit code.

Other vulnerabilities in cursor

• CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory Critical 9.3
• CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization Critical 9.3
• CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link High 8.8
• CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows High 8.8
• CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made