CVE-2025-61592: Cursor CLI remote code execution via malicious repository config

Summary

CVE-2025-61592 affects Cursor, a code editor built for programming with AI, in versions 1.7 and below. The Cursor CLI automatically loads project-specific configuration from <project>/.cursor/cli.json, and this can override certain global settings. A user running the CLI inside a malicious repository can be exposed to Remote Code Execution when that configuration permits shell commands and prompt injection is delivered through project Rules at <project>/.cursor/rules/rule.mdc or other mechanisms.

Mitigation

Fixed by patch 2025.09.17-25b418f. As of October 3, 2025 there is no release version.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)