Cursorは、Prompt Injectionを利用した.code-workspaceファイル経由でRCEの脆弱性を持っています

The vulnerability stems from Cursor's handling of Visual Studio Code Workspaces. Workspaces, which utilize .code-workspace files, store project settings and folder configurations. An attacker could craft a malicious .code-workspace file that, when opened by a vulnerable Cursor instance, triggers the execution of arbitrary code. This could lead to complete system compromise, including data theft, malware installation, and unauthorized access to sensitive information. The attack vector is particularly concerning because users may unknowingly open malicious workspaces from untrusted sources, or if a malicious workspace is already present in their environment.

Developers and users of Cursor who rely on Visual Studio Code Workspaces are at risk. This includes those who frequently work with multiple projects or collaborate with others on codebases. Users who have previously downloaded or opened .code-workspace files from untrusted sources are particularly vulnerable.

• vscode / workspace: Check for unusual .code-workspace files in user directories.

Get-ChildItem -Path $env:USERPROFILE -Filter *.code-workspace -Recurse | Select-Object FullName

• vscode / workspace: Monitor Cursor process for unexpected child processes.

Get-Process Cursor | Select-Object -ExpandProperty Children | Where-Object {$_.ProcessName -notlike 'Cursor*'}

• vscode / workspace: Examine Cursor logs for errors related to workspace loading or parsing. (Log location varies by OS). • generic web: Scan user directories for suspicious .code-workspace files using antivirus or endpoint detection and response (EDR) solutions.

1. 2025-10-03Disclosure

   disclosure

1. 予約済み2025-09-26
2. 公開日2025-10-03
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-61590 is to upgrade Cursor to version 1.7 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, users should exercise extreme caution when opening .code-workspace files, especially those from untrusted sources. Consider temporarily disabling the automatic loading of workspaces if possible. While a WAF or proxy cannot directly mitigate this vulnerability, implementing strict file access controls and scanning for malicious .code-workspace files can provide an additional layer of defense. Regularly review and audit workspace configurations to identify and remove any suspicious entries.