Cursor - vulnerabilities (CVEs)

29 CVEs in 1 products, 0 in the last 30 days, newest from 2026-08-11.

Products

Cursor - 28 CVEs

Newest CVEs of Cursor

CVE-2026-73218 - CVSS 7.7 (high), 2026-08-11: Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker…
CVE-2026-73217 - CVSS 7.7 (high), 2026-08-11: Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a…
CVE-2026-61613 - CVSS 7.7 (high), 2026-07-15: Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed…
CVE-2026-50548 - CVSS 9.8 (critical), 2026-06-25: Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write…
CVE-2026-50549 - CVSS 9.8 (critical), 2026-06-25: Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent…
CVE-2026-48124 - CVSS 8.5 (high), 2026-06-15: Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands…
CVE-2026-31854 - CVSS 8.8 (high), 2026-03-11: Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to…
CVE-2026-26268 - CVSS 9.9 (critical), 2026-02-13: Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent…
CVE-2026-22708 - CVSS 9.8 (critical), 2026-01-14: Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain…
CVE-2025-62354 - CVSS 9.8 (critical), 2025-11-26: Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are…
CVE-2025-64109 - CVSS 8.8 (high), 2025-11-05: Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote…
CVE-2025-64110 - CVSS 8.7 (high), 2025-11-05: Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should…
CVE-2025-64106 - CVSS 8.8 (high), 2025-11-04: Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables…
CVE-2025-64108 - CVSS 8.8 (high), 2025-11-04: Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent…
CVE-2025-64107 - CVSS 8.8 (high), 2025-11-04: Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path…
CVE-2025-59944 - CVSS 9.8 (critical), 2025-10-03: Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive…
CVE-2025-61593 - CVSS 8.8 (high), 2025-10-03: Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files…
CVE-2025-61592 - CVSS 8.8 (high), 2025-10-03: Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current…
CVE-2025-61591 - CVSS 8.8 (high), 2025-10-03: Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker…
CVE-2025-61590 - CVSS 7.5 (high), 2025-10-03: Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code…
CVE-2025-61589 - CVSS 5.9 (medium), 2025-10-03: Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get…
CVE-2025-9190 - CVSS 4.8 (medium), 2025-08-26: The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code…
CVE-2025-54135 - CVSS 9.8 (critical), 2025-08-05: Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is…
CVE-2025-54130 - CVSS 9.8 (critical), 2025-08-05: Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file…
CVE-2025-54136 - CVSS 8.8 (high), 2025-08-02: Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an…
CVE-2025-54133 - CVSS 9.6 (critical), 2025-08-02: Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model…
CVE-2025-54131 - CVSS 8.8 (high), 2025-08-01: Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or…
CVE-2025-54132 - CVSS 7.5 (high), 2025-08-01: Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then…
CVE-2024-48919 - CVSS 9.2 (critical), 2024-10-22: Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K…