CVE-2025-59944
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.
Vendor
Product
CWE
Yayın Tarihi
2025-10-03 21:15:34
Güncelleme
2025-10-16 18:16:19
Source Identifier
security-advisories@github.com
KEV Date Added
-