CVE-2025-64106
Published: 04 November 2025
Summary
CVE-2025-64106 is a high-severity OS Command Injection (CWE-78) vulnerability in Anysphere Cursor. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-64106 is an input validation vulnerability (CWE-78: OS Command Injection) affecting Cursor, an AI-powered code editor for programming, in versions 1.7.28 and below. The flaw exists in Cursor's MCP server installation process, where specially crafted deep-links can bypass standard security warnings. This allows attackers to conceal the commands that would be executed if a user accepts the server installation prompt.
The attack requires an attacker to convince a victim to navigate to a malicious deep-link, typically via social engineering such as phishing. A remote, unauthenticated attacker (PR:N) with network access (AV:N) can exploit this with low complexity (AC:L), though it requires user interaction (UI:R) to accept the altered speedbump modal. Successful exploitation leads to high-impact arbitrary command execution on the victim's system (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8.
For mitigation details, including patches and advisories, refer to the GitHub Security Advisory at https://github.com/cursor/cursor/security/advisories/GHSA-4575-fh42-7848. The vulnerability was published on 2025-11-04.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37908
Vulnerability details
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users…
more
if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables OS command injection (T1059) via crafted deep-links exploiting client app vuln (T1203), tricking users into execution (T1204.001), and bypassing security warnings (T1211).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the input validation flaw enabling OS command injection via specially crafted deep-links in Cursor's MCP server installation.
Requires timely remediation of the specific flaw through vendor patches as referenced in the GitHub Security Advisory.
Restricts or controls user-installed software to mitigate risks during the vulnerable MCP server installation process triggered by deep-links.