Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

cursor — Vulnerabilities & Security Advisories 31

All 31 CVE vulnerabilities found in cursor, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumeration (CWE) vulnerabilities associated with Cursor, an AI-powered code editor developed by Anysphere. It aggregates data regarding security flaws and software weaknesses specifically impacting the Cursor product ecosystem. The collection encompasses a diverse range of vulnerability types, including improper access control, injection flaws, and configuration errors that may affect the stability or security of the integrated development environment. The data covers vulnerabilities identified and reported within the last five years, providing a historical perspective on the software's security posture. This timeframe ensures that both legacy issues and recent findings are accessible for comprehensive analysis. Visitors can use this resource to track Anysphere’s vulnerability advisories and understand the specific contexts in which certain weakness classes have been exploited or identified within the Cursor application. Users may also look up the product’s vulnerability history to assess risks associated with specific versions or to compare security trends over time. By consolidating these details, the page serves as a centralized reference for developers and security professionals seeking to evaluate the integrity of the Cursor development toolchain. The information is organized to facilitate the identification of patterns in defect resolution and to support informed decision-making regarding software updates and patch management strategies without requiring external cross-referencing for basic context.

Vendor: getcursor

CVE IDTitleCVSSSeverityPublished
CVE-2026-63093 Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace CWE-426 8.8 High2026-07-17
CVE-2026-61613 Cursor: Cloud Agent Browser Sandbox Escape CWE-306--2026-07-15
CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory CWE-22--2026-06-25
CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization CWE-59--2026-06-25
CVE-2026-48124 Cursor Desktop sandbox escape via Claude hook configuration CWE-829--2026-06-15
CVE-2026-31854 Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass CWE-78 8.8AIHighAI2026-03-11
CVE-2026-26268 Cursor sandbox escape via Git hooks CWE-862 8.1 High2026-02-13
CVE-2026-22708 Cursor has a Terminal Tool Allowlist Bypass via Environment Variables CWE-15 9.1AICriticalAI2026-01-14
CVE-2025-62354 Cursor 安全漏洞 CWE-78 9.8 Critical2025-11-26
CVE-2025-64110 Cursor: Authentication Bypass Possible via New Cursorignore Write CWE-284 6.5AIMediumAI2025-11-04
CVE-2025-64109 Cursor CLI Beta: Command Injection via Untrusted MCP Configuration CWE-78 8.8 High2025-11-04
CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks CWE-22 8.8 High2025-11-04
CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows CWE-22 8.8 High2025-11-04
CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link CWE-78 8.8 High2025-11-04
CVE-2025-59944 Cursor IDE: Sensitive File Overwrite Bypass is Possible CWE-178 8.1 High2025-10-03
CVE-2025-61593 Cursor CLI Agent: Sensitive File Overwrite Bypass CWE-178 7.1 High2025-10-03
CVE-2025-61592 Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config CWE-829 8.8 High2025-10-03
CVE-2025-61591 Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution CWE-78 8.8 High2025-10-03
CVE-2025-61590 Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection CWE-94 7.5 High2025-10-03
CVE-2025-61589 Cursor: Potential Information Leakage via Mermaid Diagram CWE-200 5.9 Medium2025-10-03
CVE-2025-9190 TCC Bypass via misconfigured Node fuses in Cursor CWE-276 7.3AIHighAI2025-08-26
CVE-2025-54130 Cursor Agent is vulnerable prompt injection via Editor Special Files CWE-285 7.5 High2025-08-05
CVE-2025-54135 Cursor Agent is vulnerable to prompt injection via MCP Special Files CWE-78 8.6 High2025-08-05
CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals CWE-78 7.2 High2025-08-01
CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog CWE-78 8.1 -2025-08-01
CVE-2025-54132 Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch CWE-918 4.4 Medium2025-08-01
CVE-2025-54131 Cursor bypasses its allow list to execute arbitrary commands CWE-77 6.4 Medium2025-08-01
CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema CWE-200 5.9 Medium2025-06-11
CVE-2025-32018 Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs CWE-22 8.1 High2025-04-08
CVE-2024-48919 RCE via Prompt Injection Into Cursor's Terminal Cmd-K CWE-20 8.8AIHighAI2024-10-22

All 31 known CVE vulnerabilities affecting cursor with full Chinese analysis, references, and POCs where available.