CVE-2025-32018: Arbitrary File Access in Cursor

The core impact of CVE-2025-32018 lies in the potential for unauthorized file modification. An attacker, through carefully crafted prompts, could trick the Cursor Agent into writing data to arbitrary locations within the user's workspace. While the description emphasizes the impracticality of direct exploitation, the possibility of overwriting configuration files, source code, or other critical assets exists. The blast radius is limited to the user's workspace, but the consequences of successful modification could range from minor disruptions to complete compromise of the development environment. This vulnerability highlights the risks associated with AI-powered tools and the importance of robust security controls around agent behavior.

1. Reserved2025-04-01
2. Published2025-04-08
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32018 is to upgrade to Cursor version 0.48.7 or later, which addresses the regression. In situations where immediate upgrading is not feasible, users should exercise extreme caution when interacting with the Cursor Agent, particularly when providing prompts. Limiting the scope of the workspace and restricting the Agent's access to sensitive directories can further reduce the risk. Consider implementing prompt validation and sanitization techniques to prevent malicious input. There are no specific WAF or proxy rules applicable to this vulnerability, as it stems from application logic.