Anysphere Cursor vulnerabilities

• anysphere cursor Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace CVE-2026-63093 8.7 HighJuly 17, 2026
• anysphere cursor Cursor Desktop sandbox escape via agent-controlled working directory CVE-2026-50548 9.3 CriticalJune 25, 2026
• anysphere cursor Cursor Desktop sandbox escape via symlink and failed path canonicalization CVE-2026-50549 9.3 CriticalJune 25, 2026
• anysphere cursor Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass CVE-2026-31854 8.7 HighMarch 11, 2026
• anysphere cursor Cursor sandbox escape via Git hooks CVE-2026-26268 Public exploit 8.1 HighFebruary 13, 2026
• anysphere cursor Cursor has a Terminal Tool Allowlist Bypass via Environment Variables CVE-2026-22708 7.2 HighJanuary 14, 2026
• anysphere cursor Cursor: Authentication Bypass Possible via New Cursorignore Write CVE-2025-64110 8.7 HighNovember 4, 2025
• anysphere cursor Cursor's Sensitive File Modification can Lead to NTFS Path Quirks CVE-2025-64108 8.8 HighNovember 4, 2025
• anysphere cursor Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows CVE-2025-64107 8.8 HighNovember 4, 2025
• anysphere cursor Cursor: Speedbump Modal Bypass in MCP Server Deep-Link CVE-2025-64106 8.8 HighNovember 4, 2025
• anysphere cursor Cursor IDE: Sensitive File Overwrite Bypass is Possible CVE-2025-59944 8.1 HighOctober 3, 2025
• anysphere cursor Cursor CLI Agent: Sensitive File Overwrite Bypass CVE-2025-61593 7.1 HighOctober 3, 2025
• anysphere cursor Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config CVE-2025-61592 8.8 HighOctober 3, 2025
• anysphere cursor Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution CVE-2025-61591 8.8 HighOctober 3, 2025
• anysphere cursor Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection CVE-2025-61590 7.5 HighOctober 3, 2025
• anysphere cursor Cursor: Potential Information Leakage via Mermaid Diagram CVE-2025-61589 5.9 MediumOctober 3, 2025
• anysphere cursor Cursor Agent is vulnerable prompt injection via Editor Special Files CVE-2025-54130 7.5 HighAugust 5, 2025
• anysphere cursor Cursor Agent is vulnerable to prompt injection via MCP Special Files CVE-2025-54135 Public exploit 8.6 HighAugust 5, 2025
• anysphere cursor Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals CVE-2025-54136 Public exploit EPSS 31.5% 7.2 HighAugust 1, 2025
• anysphere cursor Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog CVE-2025-54133 5.3 MediumAugust 1, 2025
• anysphere cursor Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch CVE-2025-54132 4.4 MediumAugust 1, 2025
• anysphere cursor Cursor bypasses its allow list to execute arbitrary commands CVE-2025-54131 6.4 MediumAugust 1, 2025