CVE-2025-54130: Cursor Agent is vulnerable prompt injection via Editor Special Files
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54130?
CVE-2025-54130 is classified as a moderate severity vulnerability due to the potential unauthorized file modifications.
How do I fix CVE-2025-54130?
To fix CVE-2025-54130, update Cursor to version 1.3.9 or later where the vulnerability is addressed.
What kind of files are affected by CVE-2025-54130?
CVE-2025-54130 affects all writable files in Cursor versions less than 1.3.9 and requires user approval only for dotfiles.
What can an attacker do with CVE-2025-54130?
An attacker could exploit CVE-2025-54130 to create or modify sensitive files without user consent.
Is my version of Cursor vulnerable to CVE-2025-54130?
If you are using a version of Cursor lower than 1.3.9, your software is vulnerable to CVE-2025-54130.