CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link

What is CVE-2025-64106?

CVE-2025-64106 is a high-severity command injection vulnerability in cursor, published on 4 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink.

Weakness: CWE-78

Which versions are affected by CVE-2025-64106?

It affects 1 product.

Products include Anysphere Cursor.

How do I fix CVE-2025-64106?

No fix has been published for CVE-2025-64106 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-64106 being exploited?

There is no known exploitation of CVE-2025-64106 in the wild and no public exploit code.

Other vulnerabilities in cursor

• CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory Critical 9.3
• CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization Critical 9.3
• CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows High 8.8
• CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks High 8.8
• CVE-2025-61591 Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made