PT-2025-40600

CVE-2025-59944

Published

2025-10-03

Updated

2026-10-19

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cursor versions 1.6.23 and below

Description Cursor IDE has case-sensitive checks when protecting sensitive files, such as /.cursor/mcp.json. This allows attackers to modify these files through prompt injection, potentially leading to remote code execution (RCE). This is possible on case-insensitive file systems. A prompt injection can result in full RCE by modifying sensitive files.

Recommendations Update to version 1.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-178: Improper Handling of Case Sensitivity

Related identifiers

CVE-2025-59944