{"data":{"id":"29536bb7-8386-46b1-be4a-6e98a9ecfa5d","title":"CVE-2025-61591: Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication…","summary":"CVE-2025-61591 affects Cursor, a code editor built for programming with AI, in versions 1.7 and below. When MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate that server and return crafted commands during interaction, enabling command injection. Chained with an untrusted MCP service via OAuth, the flaw could let the agent execute arbitrary code on the host with full user privileges.","solution":"This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61591","publishedAt":"2025-10-03T17:15:47.853Z","cveId":"CVE-2025-61591","cweIds":["CWE-78"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Cursor","MCP (Model Context Protocol)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Cursor command injection via MCP OAuth with untrusted server","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01159,"epssCheckedAt":"2026-11-05T00:11:43.030Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:40.384Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}