CVE-2025-59944: Cursor IDE: Sensitive File Overwrite Bypass is Possible

Published Oct 3, 2025
·
Updated

Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., /.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.

Affected Software

2 affected components
Cursor Cursor IDE<=1.6.23
anysphere Cursor<=1.6.23

Event History

Oct 3, 2025
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-59944?

CVE-2025-59944 has been rated with high severity due to its potential for prompt injection attacks against sensitive files.

2

How do I fix CVE-2025-59944?

To fix CVE-2025-59944, upgrade Cursor IDE to version 1.6.24 or later where the case sensitivity issue has been addressed.

3

What versions of Cursor IDE are affected by CVE-2025-59944?

Cursor IDE versions 1.6.23 and below are affected by CVE-2025-59944.

4

What types of files are vulnerable in CVE-2025-59944?

CVE-2025-59944 affects sensitive files like */.cursor/mcp.json due to improper case-sensitive checks.

5

Can CVE-2025-59944 lead to data manipulation?

Yes, CVE-2025-59944 allows attackers to modify the content of sensitive files through prompt injection.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203