CVE-2025-61592
Published: 03 October 2025
Summary
CVE-2025-61592 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Anysphere Cursor. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Developer Utilities Proxy Execution (T1127); ranked in the top 48.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely installation of the patch 2025.09.17-25b418f directly remediates the flaw allowing automatic loading of untrusted .cursor/cli.json configurations that override globals for RCE.
Validates and sanitizes inputs from untrusted project-specific .cursor/cli.json and .cursor/rules/rule.mdc files to prevent configuration overrides and prompt injections enabling shell command execution.
Restricts Cursor CLI to least functionality by prohibiting shell commands and automatic loading of project-specific configurations from untrusted directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via malicious project-specific CLI configuration (.cursor/cli.json) and rules (.cursor/rules/rule.mdc) files that override globals and leverage prompt injection to execute shell commands, facilitating proxy execution via the trusted developer utility Cursor CLI and exploitation of a client application.
NVD Description
Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configurations in Cursor CLI. This allowed users running the…
more
CLI inside a malicious repository to be vulnerable to Remote Code Execution through a combination of permissive configuration (allowing shell commands) and prompt injection delivered via project-specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms. The fix for this issue is currently available as a patch 2025.09.17-25b418f. As of October 3, 2025 there is no release version.
Deeper analysisAI
CVE-2025-61592 is a high-severity vulnerability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) affecting Cursor, an AI-powered code editor for programming, in versions 1.7 and below. The issue stems from the Cursor CLI's automatic loading of project-specific configuration from the current working directory file .cursor/cli.json, which can override certain global configurations. This flaw, classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), enables remote code execution when combined with permissive configuration settings that allow shell commands and prompt injection delivered through project-specific rules in .cursor/rules/rule.mdc or other mechanisms.
The attack requires a user to run the Cursor CLI inside a malicious repository, typically after cloning it via social engineering or other user interaction (UI:R). No privileges are needed from the attacker (PR:N), who can achieve network-accessible exploitation (AV:N) with low complexity (AC:L). Successful exploitation leads to high-impact compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) through arbitrary code execution on the victim's system.
The official advisory is available at https://github.com/cursor/cursor/security/advisories/GHSA-v64q-396f-7m79. Mitigation is provided via patch 2025.09.17-25b418f, released prior to the CVE publication on October 3, 2025, though no stable release version incorporates the fix as of that date.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Cursor is an AI-powered code editor designed for programming with AI, classifying it as an Enterprise AI Assistant due to its integration of AI for developer workflows.