Advisories · Technology
cursor.
Every CVE that names cursor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Cursor: Sandbox escape via launching privileged containers
- cursor
- Privilege escalation
- CVSS 7.7 High
Cursor: Sandbox escape via tampered Python virtual environments
- cursor
- CWE-693
- CVSS 7.7 High
Cursor: Cloud Agent Browser Sandbox Escape
- cursor
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Cursor Desktop sandbox escape via agent-controlled working directory
- cursor
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Cursor Desktop sandbox escape via symlink and failed path canonicalization
- cursor
- Path traversal
- CVSS 8.5 High
Cursor Desktop sandbox escape via Claude hook configuration
- cursor
- Code injection
- CWE-829
- CVSS 8.7 High
Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass
- cursor
- Command injection
- CVSS 8.1 High
Cursor sandbox escape via Git hooks
- cursor
- Broken access control
- CVSS 7.2 High
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
- cursor
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
OS command injection in cursor
- cursor
- Command injection
- CVSS 8.7 High
Cursor: Authentication Bypass Possible via New Cursorignore Write
- cursor
- Broken access control
- CVSS 8.8 High
Cursor CLI Beta: Command Injection via Untrusted MCP Configuration
- cursor
- Command injection
- CVSS 8.8 High
Cursor's Sensitive File Modification can Lead to NTFS Path Quirks
- cursor
- Path traversal
- Code injection
- CVSS 8.8 High
Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
- cursor
- Path traversal
- CVSS 8.8 High
Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
- cursor
- Command injection
- CVSS 8.1 High
Cursor IDE: Sensitive File Overwrite Bypass is Possible
- cursor
- CWE-178
- CVSS 7.1 High
Cursor CLI Agent: Sensitive File Overwrite Bypass
- cursor
- Code injection
- CWE-178
- CVSS 8.8 High
Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config
- cursor
- CWE-829
- CVSS 8.8 High
Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution
- cursor
- Command injection
- CVSS 7.5 High
Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection
- cursor
- Code injection
- CVSS 5.9 Medium
Cursor: Potential Information Leakage via Mermaid Diagram
- cursor
- Information disclosure
- CVSS 4.8 Medium
TCC Bypass via misconfigured Node fuses in Cursor
- Cursor
- Broken access control
- CVSS 7.5 High
Cursor Agent is vulnerable prompt injection via Editor Special Files
- cursor
- Broken access control
- CVSS 8.6 High
Cursor Agent is vulnerable to prompt injection via MCP Special Files
- cursor
- Command injection
- CWE-829
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
- cursor
- Command injection
- CVSS 5.3 Medium
Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog
- cursor
- Command injection
- Information disclosure
- CVSS 4.4 Medium
Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch
- cursor
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Cursor bypasses its allow list to execute arbitrary commands
- cursor
- Command injection
- CVSS 5.9 Medium
Cursor Agent Potentially Leaks Information using JSON schema
- cursor
- Information disclosure
- CVSS 8.1 High
Arbitrary file write from Cursor Agent through a prompt injection from malicious @Docs
- cursor
- Path traversal
- CVSS 9.2 CriticalCritical · CVSS 9+
RCE via Prompt Injection Into Cursor's Terminal Cmd-K
- cursor
- CWE-20
- CVSS 3.8 Low
TCC Bypass in Cursor's macOS Application
- cursor
- CWE-277