Willkürliches Schreiben von Dateien vom Cursor Agent über eine Prompt-Injektion von bösartigen @Docs

The core impact of CVE-2025-32018 lies in the potential for unauthorized file modification. While the vulnerability requires deliberate prompting, a successful attacker could leverage this to alter configuration files, inject malicious code, or compromise sensitive data within the workspace. The blast radius is limited to the files accessible by the Cursor Agent and the user's permissions. Although exploitation is deemed highly impractical due to the need for specific prompting, the potential for data compromise remains a concern, especially in environments where the Cursor Agent has elevated privileges or access to sensitive directories. This vulnerability highlights the importance of carefully reviewing and restricting the permissions granted to AI-powered tools within a development environment.

Developers using Cursor, particularly those working with sensitive code or configuration files, are at risk. Users who rely on the Cursor Agent for automated tasks or code generation are also potentially vulnerable. Shared development environments or workspaces could amplify the impact if one user's account is compromised.

• vscode / supply-chain: Examine Cursor extension settings for unusual file access permissions. Check for suspicious modifications to workspace configuration files. • generic web: Monitor Cursor Agent logs for unexpected file write operations. Review user activity for prompts that might trigger the vulnerability.

Get-Process -Name Cursor | Select-Object -ExpandProperty Path

1. 2025-04-08Disclosure

   disclosure

1. Reserviert2025-04-01
2. Veröffentlicht2025-04-08
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-32018 is to immediately upgrade to Cursor version 0.48.7 or later. Prior to upgrading, consider backing up your Cursor configuration and workspace to prevent data loss. If upgrading is not immediately feasible, carefully review the Cursor Agent's permissions and restrict its access to only the necessary files and directories. Monitor Cursor's activity logs for any unusual file modification attempts. While no specific WAF or proxy rules are applicable, implementing strict file access controls at the operating system level can further reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the file modification scenario described in the advisory and verifying that the agent is restricted to the intended workspace.