Overview
CVE-2025-61590 is a critical security vulnerability found in Cursor, a code editor built for programming with AI. This vulnerability primarily affects users of versions 1.6 and below and enables an attacker to execute remote code through Visual Studio Code Workspaces. Such a vulnerability makes it possible for potential system compromise or data leakage, emphasizing the need for immediate attention and mitigation.
Vulnerability Summary
CVE ID: CVE-2025-61590
Severity: High (7.5 CVSS Score)
Attack Vector: Remote
Privileges Required: Low
User Interaction: Required
Impact: Remote Code Execution leading to system compromise and potential data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Cursor Code Editor | 1.6 and below
How the Exploit Works
The vulnerability is due to an issue with Cursor’s handling of Visual Studio Code Workspaces. These workspaces permit users to open multiple folders and save particular settings, creating an untitled workspace automatically. If an attacker successfully hijacks the chat context of the victim, for example, through a compromised MCP server, they can prompt the Cursor Agent to write into this file and alter the workspace. This action bypasses CVE-2025-54130, enabling an attacker to carry out a Remote Code Execution by writing to the settings section.
Conceptual Example Code
Given the nature of the vulnerability, an example of a potential exploit might involve a malicious actor injecting a payload through a compromised MCP server. This could be conceptually represented like this:
// Attacker hijacks the chat context
hijack_chat_context(victim, compromised_MCP_server);
// Attacker injects payload to modify .code-workspace file
inject_payload("untitled.code-workspace", "malicious_payload");
// Attacker triggers RCE by writing to the settings section
trigger_rce("settings.json");Please note that this is a conceptual representation and does not represent actual exploitation code.