CVE-2025-61592 Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config
Attackers can execute arbitrary code by tricking users into running the CLI in a malicious repository with permissive configuration settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-61592?
CVE-2025-61592 is a high-severity code injection vulnerability in cursor, published on 3 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configurations in Cursor CLI. This allowed users running the CLI inside a malicious repository to be vulnerable to Remote Code Execution through a combination of permissive configuration (allowing shell commands) and prompt injection delivered via project-specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms. The fix for this issue is currently available as a patch 2025.09.17-25b418f. As of October 3, 2025 there is no release version.
Weakness: CWE-829
Which versions are affected by CVE-2025-61592?
It affects 1 product.
Products include Anysphere Cursor.
How do I fix CVE-2025-61592?
No fix has been published for CVE-2025-61592 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-61592 being exploited?
There is no known exploitation of CVE-2025-61592 in the wild and no public exploit code.
Other vulnerabilities in cursor
- CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
- CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
- CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
- CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
- CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks