CVE-2025-61590: RCE in Cursor Code Editor

The vulnerability stems from Cursor's handling of Visual Studio Code Workspaces. Workspaces, which utilize .code-workspace files, store project settings and folder configurations. An attacker could craft a malicious .code-workspace file that, when opened by a vulnerable Cursor instance, triggers the execution of arbitrary code. This could lead to complete system compromise, including data theft, malware installation, and unauthorized access to sensitive information. The attack vector is particularly concerning because users may unknowingly open malicious workspaces from untrusted sources, or if a malicious workspace is already present in their environment.

1. Reserved2025-09-26
2. Published2025-10-03
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-61590 is to upgrade Cursor to version 1.7 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, users should exercise extreme caution when opening .code-workspace files, especially those from untrusted sources. Consider temporarily disabling the automatic loading of workspaces if possible. While a WAF or proxy cannot directly mitigate this vulnerability, implementing strict file access controls and scanning for malicious .code-workspace files can provide an additional layer of defense. Regularly review and audit workspace configurations to identify and remove any suspicious entries.