Cursor vulnerabilities

Products

• Cursor 33

Newest

• cursor Cursor: Sandbox escape via launching privileged containers CVE-2026-73218 7.7 HighAugust 11, 2026
• cursor Cursor: Sandbox escape via tampered Python virtual environments CVE-2026-73217 7.7 HighAugust 11, 2026
• anysphere cursor Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace CVE-2026-63093 8.7 HighJuly 17, 2026
• cursor Cursor: Cloud Agent Browser Sandbox Escape CVE-2026-61613 7.7 HighJuly 15, 2026
• anysphere cursor Cursor Desktop sandbox escape via agent-controlled working directory CVE-2026-50548 9.3 CriticalJune 25, 2026
• anysphere cursor Cursor Desktop sandbox escape via symlink and failed path canonicalization CVE-2026-50549 9.3 CriticalJune 25, 2026
• cursor Cursor Desktop sandbox escape via Claude hook configuration CVE-2026-48124 8.5 HighJune 15, 2026
• anysphere cursor Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass CVE-2026-31854 8.7 HighMarch 11, 2026
• anysphere cursor Cursor sandbox escape via Git hooks CVE-2026-26268 Public exploit 8.1 HighFebruary 13, 2026
• anysphere cursor Cursor has a Terminal Tool Allowlist Bypass via Environment Variables CVE-2026-22708 7.2 HighJanuary 14, 2026
• cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor... CVE-2025-62354 9.8 CriticalNovember 26, 2025
• anysphere cursor Cursor: Authentication Bypass Possible via New Cursorignore Write CVE-2025-64110 8.7 HighNovember 4, 2025
• cursor Cursor CLI Beta: Command Injection via Untrusted MCP Configuration CVE-2025-64109 8.8 HighNovember 4, 2025
• anysphere cursor Cursor's Sensitive File Modification can Lead to NTFS Path Quirks CVE-2025-64108 8.8 HighNovember 4, 2025
• anysphere cursor Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows CVE-2025-64107 8.8 HighNovember 4, 2025
• anysphere cursor Cursor: Speedbump Modal Bypass in MCP Server Deep-Link CVE-2025-64106 8.8 HighNovember 4, 2025
• anysphere cursor Cursor IDE: Sensitive File Overwrite Bypass is Possible CVE-2025-59944 8.1 HighOctober 3, 2025
• anysphere cursor Cursor CLI Agent: Sensitive File Overwrite Bypass CVE-2025-61593 7.1 HighOctober 3, 2025
• anysphere cursor Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config CVE-2025-61592 8.8 HighOctober 3, 2025
• anysphere cursor Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution CVE-2025-61591 8.8 HighOctober 3, 2025
• anysphere cursor Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection CVE-2025-61590 7.5 HighOctober 3, 2025
• anysphere cursor Cursor: Potential Information Leakage via Mermaid Diagram CVE-2025-61589 5.9 MediumOctober 3, 2025
• cursor TCC Bypass via misconfigured Node fuses in Cursor CVE-2025-9190 4.8 MediumAugust 26, 2025
• anysphere cursor Cursor Agent is vulnerable prompt injection via Editor Special Files CVE-2025-54130 7.5 HighAugust 5, 2025
• anysphere cursor Cursor Agent is vulnerable to prompt injection via MCP Special Files CVE-2025-54135 Public exploit 8.6 HighAugust 5, 2025
• anysphere cursor Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals CVE-2025-54136 Public exploit EPSS 31.5% 7.2 HighAugust 1, 2025
• anysphere cursor Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog CVE-2025-54133 5.3 MediumAugust 1, 2025
• anysphere cursor Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch CVE-2025-54132 4.4 MediumAugust 1, 2025
• anysphere cursor Cursor bypasses its allow list to execute arbitrary commands CVE-2025-54131 6.4 MediumAugust 1, 2025
• cursor Cursor Agent Potentially Leaks Information using JSON schema CVE-2025-49150 5.9 MediumJune 11, 2025
• cursor Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs CVE-2025-32018 8.1 HighApril 8, 2025
• cursor RCE via Prompt Injection Into Cursor's Terminal Cmd-K CVE-2024-48919 9.2 CriticalOctober 22, 2024
• cursor TCC Bypass in Cursor's macOS Application CVE-2024-45599 3.8 LowSeptember 24, 2024