CVE-2025-59944: Cursor IDE: Sensitive File Overwrite Bypass is Possible
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., /.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59944?
CVE-2025-59944 has been rated with high severity due to its potential for prompt injection attacks against sensitive files.
How do I fix CVE-2025-59944?
To fix CVE-2025-59944, upgrade Cursor IDE to version 1.6.24 or later where the case sensitivity issue has been addressed.
What versions of Cursor IDE are affected by CVE-2025-59944?
Cursor IDE versions 1.6.23 and below are affected by CVE-2025-59944.
What types of files are vulnerable in CVE-2025-59944?
CVE-2025-59944 affects sensitive files like */.cursor/mcp.json due to improper case-sensitive checks.
Can CVE-2025-59944 lead to data manipulation?
Yes, CVE-2025-59944 allows attackers to modify the content of sensitive files through prompt injection.