CVE-2025-64106
Published: 04 November 2025
Summary
CVE-2025-64106 is a high-severity OS Command Injection (CWE-78) vulnerability in Anysphere Cursor. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the input validation flaw enabling OS command injection via specially crafted deep-links in Cursor's MCP server installation.
Requires timely remediation of the specific flaw through vendor patches as referenced in the GitHub Security Advisory.
Restricts or controls user-installed software to mitigate risks during the vulnerable MCP server installation process triggered by deep-links.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables OS command injection (T1059) via crafted deep-links exploiting client app vuln (T1203), tricking users into execution (T1204.001), and bypassing security warnings (T1211).
NVD Description
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users…
more
if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink.
Deeper analysisAI
CVE-2025-64106 is an input validation vulnerability (CWE-78: OS Command Injection) affecting Cursor, an AI-powered code editor for programming, in versions 1.7.28 and below. The flaw exists in Cursor's MCP server installation process, where specially crafted deep-links can bypass standard security warnings. This allows attackers to conceal the commands that would be executed if a user accepts the server installation prompt.
The attack requires an attacker to convince a victim to navigate to a malicious deep-link, typically via social engineering such as phishing. A remote, unauthenticated attacker (PR:N) with network access (AV:N) can exploit this with low complexity (AC:L), though it requires user interaction (UI:R) to accept the altered speedbump modal. Successful exploitation leads to high-impact arbitrary command execution on the victim's system (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8.
For mitigation details, including patches and advisories, refer to the GitHub Security Advisory at https://github.com/cursor/cursor/security/advisories/GHSA-4575-fh42-7848. The vulnerability was published on 2025-11-04.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Cursor is an AI-powered code editor designed for programming with AI, featuring integrations like MCP servers for AI tools, fitting the Enterprise AI Assistants category.