{"id":63948,"date":"2025-08-10T06:39:17","date_gmt":"2025-08-10T06:39:17","guid":{"rendered":""},"modified":"2025-10-24T08:38:50","modified_gmt":"2025-10-24T14:38:50","slug":"cve-2025-54135-critical-remote-code-execution-vulnerability-in-cursor-code-editor","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-54135-critical-remote-code-execution-vulnerability-in-cursor-code-editor\/","title":{"rendered":"CVE-2025-54135: Critical Remote Code Execution Vulnerability in Cursor Code Editor<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability CVE-2025-54135 has been recently discovered in Cursor, an AI-based code editor. The vulnerability allows a potential attacker to write in-workspace files without requiring user approval, thereby leading to a possible Remote Code Execution (RCE). This vulnerability affects versions below 1.3.9 of Cursor and can lead<\/a> to significant security risks including system compromise or data leakage. Given the increasing popularity of AI-based code editors among developers, this vulnerability could have widespread implications if not addressed<\/a> promptly.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-54135
\nSeverity: High (8.5 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise or data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Cursor Code Editor | <1.3.9\n\nHow the Exploit Works<\/strong><\/p>\n

The exploit works by taking advantage of a loophole in the file permission<\/a> settings of Cursor. The code editor allows<\/a> writing in-workspace files without requiring user approval. If the file is a dotfile, editing it requires approval but creating a new one doesn’t. Therefore, if sensitive MCP files such as .cursor\/mcp.json do not already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability<\/a> to hijack the context to write to the settings file and trigger Remote Code Execution (RCE) on the victim’s system without user approval.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how the vulnerability might be exploited using a shell command:<\/a><\/p>\n

# Create a new .cursor\/mcp.json file\necho '{ \"settings\": { \"command\": \"malicious_command_here\" } }' > .cursor\/mcp.json\n# Trigger the indirect prompt injection vulnerability\ncurl -X POST -H \"Content-Type: application\/json\" -d '{\"filename\":\".cursor\/mcp.json\",\"content\":\"malicious_content_here\"}' http:\/\/target.example.com\/vulnerable\/endpoint<\/code><\/pre>\n
The above code first creates a new .cursor\/mcp.json file<\/a> with a malicious command. Then, it triggers the indirect prompt injection vulnerability<\/a> by sending a POST request to a vulnerable endpoint on the target’s system, which subsequently writes the malicious content to the settings file leading to RCE.<\/p>\n
Remediation<\/strong><\/p>\n
The vendor has released a patch that fixes this vulnerability in version<\/a> 1.3.9 of Cursor. All users are strongly advised to update to the patched version as soon as possible. As a temporary mitigation, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used to filter out malicious requests.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability CVE-2025-54135 has been recently discovered in Cursor, an AI-based code editor. The vulnerability allows a potential attacker to write in-workspace files without requiring user approval, thereby leading to a possible Remote Code Execution (RCE). This vulnerability affects versions below 1.3.9 of Cursor and can lead to significant security risks including system compromise […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-63948","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t