Cursor vulnerabilities

Cursor IDE for macOS before version 3.0.0 allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read/write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt.

Cursor IDE for macOS before version 3.1.2 allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications.

A binary planting vulnerability in Cursor for Windows version 3.2.16 allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe in the repository root. When a developer clones and opens a crafted repository, Cursor automatically executes the malicious binary without user interaction.

A vulnerability in Cursor editor before 03/31/2026 allowed attacker-controlled web content to connect to an unauthenticated local agent endpoint, enabling code execution in the cloud agent sandbox and access to files, repositories, environment variables, credentials, and GitHub App tokens. The issue was fixed on 03/31/2026 by requiring authentication for the relevant endpoint.

In Cursor code editor versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones, allowing a malicious agent to read protected files.

Cursor versions 1.7.44 and below have NTFS path quirks that allow a prompt injection attacker to bypass sensitive file protections and overwrite files requiring human approval. Modification of some protected files can lead to RCE.

In Cursor code editor versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipulation via forward slashes but not via backslashes, allowing an attacker with prompt injection or other control to overwrite sensitive editor files without approval on Windows machines.

In Cursor versions 1.7.28 and below, an input validation flaw in MCP server installation lets crafted deep-links bypass standard security warnings and conceal executed commands from users. If the victim accepts the server, commands specified by the attacker's deep-link are executed.

Cursor IDE versions 1.6.23 and below use case-sensitive checks when protecting sensitive files (e.g., */.cursor/mcp.json), allowing attackers to modify their content via prompt injection. On case-insensitive filesystems this can lead to full remote code execution.

A vulnerability in Cursor code editor versions 1.7 and below. Automatic loading of project-specific CLI configuration (.cursor/cli.json) could override global settings and enable remote code execution through permissive configuration and prompt injection.

Cursor versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, allow an attacker to impersonate a malicious MCP server and return crafted, maliciously injected commands during interaction, leading to command injection and potential remote code execution. This could allow arbitrary code execution on the host by the agent with full user privileges. No fixed release version exists, but patch 2025.09.17-25b418f is available.

Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code Workspaces. If an attacker is able to hijack the chat context of the victim (such as via a compromised MCP server), they can use prompt injection to make the Cursor Agent write into the workspace file and modify settings, bypassing CVE-2025-54130 and leading to RCE.

Cursor versions 1.6 and below allow embedding images in Mermaid diagrams rendered in the chat box. Through prompt injection, an attacker can force an image fetch from an external server and exfiltrate sensitive information.