CVE-2025-59944 — Cursor IDE: Sensitive File Overwrite Bypass is Possible
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.curso…
Published: 2025-10-03 · CVSS: 8.1 · CVSS 3.1
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7