CVE-2025-61593: anysphere cursor

csirt@kutim:~/threat-intel/cve/CVE-2025-61593

CVSS 8.8 · High EPSS 0,41%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada anysphere cursor. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e. */.cursor/cli.json) allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive filesystems. This issue is fixed in a commit, 25b418f, but has yet to be released as of October 3, 2025.

Rincian

Terbit di NVD: 3 Oktober 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-178: Improper Handling of Case Sensitivity
EPSS (30 hari): 0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
anysphere	cursor	Semua versi hingga 1.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.