cursor

Records29All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

cursor records in CISA KEV

No cursor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cursor 22 records HIGH

Records

22 records in Cursor · all components

TI-2026-45043 CVE-2026-63093 · GHSA-prfr-jc65-hr23

Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

HIGH 73

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00847 Published 2026-07-17 No fix listed CWE-426

TI-2025-33979 CVE-2025-54136

Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

MEDIUM 64

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.31501 Published 2025-08-01 Fixed in 1.3 CWE-78

TI-2026-37271 CVE-2026-50549

Cursor Desktop sandbox escape via symlink and failed path canonicalization

MEDIUM 50

Cursor is a code editor built for programming with AI.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01011 Published 2026-06-25 Fixed in 3.0 CWE-59

TI-2026-37270 CVE-2026-50548

Cursor Desktop sandbox escape via agent-controlled working directory

MEDIUM 50

Cursor is a code editor built for programming with AI.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01011 Published 2026-06-25 Fixed in 3.0 CWE-22

TI-2025-38037 CVE-2025-61591

Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution

MEDIUM 48

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01159 Published 2025-10-03 No fix listed CWE-78

TI-2025-33978 CVE-2025-54135

Cursor Agent is vulnerable to prompt injection via MCP Special Files

MEDIUM 47

Cursor is a code editor built for programming with AI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0213 Published 2025-08-05 Fixed in 1.3.9 CWE-78

TI-2026-21238 CVE-2026-26268

Cursor sandbox escape via Git hooks

MEDIUM 44

Cursor is a code editor built for programming with AI.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.007 Published 2026-02-13 Fixed in 2.5 CWE-862

TI-2025-39561 CVE-2025-64110

Cursor: Authentication Bypass Possible via New Cursorignore Write

MEDIUM 44

Cursor is a code editor built for programming with AI.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0039 Published 2025-11-04 Fixed in 2.0 CWE-284

TI-2025-37332 CVE-2025-59944

Cursor IDE: Sensitive File Overwrite Bypass is Possible

MEDIUM 43

Cursor is a code editor built for programming with AI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00506 Published 2025-10-03 Fixed in 1.7 CWE-178

TI-2025-33973 CVE-2025-54130

Cursor Agent is vulnerable prompt injection via Editor Special Files

MEDIUM 43

Cursor is a code editor built for programming with AI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00359 Published 2025-08-05 Fixed in 1.3.9 CWE-285

TI-2025-39559 CVE-2025-64108

Cursor's Sensitive File Modification can Lead to NTFS Path Quirks

MEDIUM 41

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00485 Published 2025-11-04 Fixed in 2.0 CWE-22

TI-2025-33974 CVE-2025-54131

Cursor bypasses its allow list to execute arbitrary commands

MEDIUM 41

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00538 Published 2025-08-01 Fixed in 1.3 CWE-77

TI-2026-24407 CVE-2026-31854

Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass

MEDIUM 40

Cursor is a code editor built for programming with AI.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00364 Published 2026-03-11 Fixed in 2.0 CWE-78

TI-2025-39558 CVE-2025-64107

Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows

MEDIUM 40

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00382 Published 2025-11-04 Fixed in 2.0 CWE-22

TI-2025-39557 CVE-2025-64106

Cursor: Speedbump Modal Bypass in MCP Server Deep-Link

MEDIUM 40

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00395 Published 2025-11-04 Fixed in 2.0 CWE-78

TI-2025-38038 CVE-2025-61592

Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config

MEDIUM 40

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00455 Published 2025-10-03 No fix listed CWE-829

TI-2025-38039 CVE-2025-61593

Cursor CLI Agent: Sensitive File Overwrite Bypass

LOW 38

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00421 Published 2025-10-03 No fix listed CWE-178

TI-2025-38036 CVE-2025-61590

Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection

LOW 36

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00532 Published 2025-10-03 Fixed in 1.7 CWE-94

TI-2026-18235 CVE-2026-22708

Cursor has a Terminal Tool Allowlist Bypass via Environment Variables

LOW 35

Cursor is a code editor built for programming with AI.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00817 Published 2026-01-14 Fixed in 2.3 CWE-15

TI-2025-33975 CVE-2025-54132

Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch

LOW 33

Cursor is a code editor built for programming with AI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.004 Published 2025-08-01 Fixed in 1.3 CWE-918

TI-2025-38035 CVE-2025-61589

Cursor: Potential Information Leakage via Mermaid Diagram

LOW 26

Cursor is a code editor built for programming with AI.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00294 Published 2025-10-03 Fixed in 1.7 CWE-200

TI-2025-33976 CVE-2025-54133

Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog

LOW 24

Cursor is a code editor built for programming with AI.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00438 Published 2025-08-01 Fixed in 1.3 CWE-200

Open these records in search →