PT-2026-60188

CVE-2026-61613

·

Published

2026-07-15

·

Updated

2026-07-21

Description by

CVSS 4.0
7.7
High
MetricsAV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Name of the Vulnerable Software and Affected Versions Cursor versions prior to 03/31/2026
Description Browser-enabled Cloud Agent sessions allow attacker-controlled web content to connect from within the agent container to an unauthenticated local agent endpoint. This allows for code execution inside the affected Cloud Agent sandbox or session, providing access to files, repository contents, environment variables, credentials, and GitHub App access tokens associated with that session.
Recommendations Update to the version released on 03/31/2026 or later.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-306: Missing Authentication for Critical Function
Related identifiers
CVE-2026-61613
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com