{"data":{"id":"c40a5610-3d67-4fe9-ba0a-139b54bfa903","title":"CVE-2025-64107: Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may…","summary":"CVE-2025-64107 affects Cursor, a code editor built for programming with AI, in versions 1.7.52 and below. Cursor checks path manipulation that uses forward slashes, such as ./.cursor/./././././mcp.json, and requires human approval before completing the operation. The same manipulation with backslashes was not detected, so an attacker who already had prompt injection or another level of control could overwrite sensitive editor files without approval on Windows machines, which may lead to RCE.","solution":"Fixed in version 2.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64107","publishedAt":"2025-11-04T23:15:44.330Z","cveId":"CVE-2025-64107","cweIds":["CWE-22"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Cursor"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Cursor editor command execution via backslash path manipulation on Windows","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00382,"epssCheckedAt":"2026-11-04T18:09:12.971Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:37.597Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}