CVE-2025-64107: RCE in Cursor Code Editor

The impact of this vulnerability is significant. A successful exploit allows an attacker to execute arbitrary code on the affected Windows machine. This could lead to complete system compromise, including data theft, malware installation, and lateral movement within the network. The ability to bypass the intended approval mechanism for file modifications amplifies the risk, as it allows attackers to silently inject malicious code into the editor's configuration or other critical files. This is particularly concerning given Cursor's use as a code editor, potentially allowing attackers to modify source code or project files.

1. Reserved2025-10-27
2. Published2025-11-04
3. Modified2025-11-07
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Cursor Code Editor to version 2.0 or later, which addresses the vulnerability. If upgrading immediately is not feasible, consider implementing stricter file access controls on the .cursor directory to limit write access to authorized users only. Monitor file system activity within the .cursor directory for any unexpected modifications, particularly those involving backslashes. While a WAF or proxy cannot directly mitigate this vulnerability, implementing robust endpoint detection and response (EDR) solutions can help detect and respond to malicious activity resulting from a successful exploit.