What’s Vulnerable › Products

cursor vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your cursor version is affected

Latest cursor vulnerabilities

• CVE-2026-73218 — Cursor: Sandbox escape via launching privileged containers (CVSS 7.7)
• CVE-2026-73217 — Cursor: Sandbox escape via tampered Python virtual environments (CVSS 7.7)
• CVE-2026-63093 — Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace (CVSS 8.8)
• CVE-2026-61613 — Cursor: Cloud Agent Browser Sandbox Escape (CVSS 7.7)
• CVE-2026-50549 — Cursor Desktop sandbox escape via symlink and failed path canonicalization (CVSS 9.8)
• CVE-2026-50548 — Cursor Desktop sandbox escape via agent-controlled working directory (CVSS 9.8)
• CVE-2026-48124 — Cursor Desktop sandbox escape via Claude hook configuration (CVSS 8.5)
• CVE-2026-31854 — Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass (CVSS 8.8)
• CVE-2026-26268 — Cursor sandbox escape via Git hooks (CVSS 9.9)
• CVE-2026-22708 — Cursor has a Terminal Tool Allowlist Bypass via Environment Variables (CVSS 9.8)
• CVE-2025-62354 — (CVSS 9.8)
• CVE-2025-64110 — Cursor: Authentication Bypass Possible via New Cursorignore Write (CVSS 7.5)
• CVE-2025-64109 — Cursor CLI Beta: Command Injection via Untrusted MCP Configuration (CVSS 8.8)
• CVE-2025-64108 — Cursor's Sensitive File Modification can Lead to NTFS Path Quirks (CVSS 8.8)
• CVE-2025-64107 — Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows (CVSS 8.8)
• CVE-2025-64106 — Cursor: Speedbump Modal Bypass in MCP Server Deep-Link (CVSS 8.8)
• CVE-2025-59944 — Cursor IDE: Sensitive File Overwrite Bypass is Possible (CVSS 9.8)
• CVE-2025-61593 — Cursor CLI Agent: Sensitive File Overwrite Bypass (CVSS 8.8)
• CVE-2025-61592 — Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config (CVSS 8.8)
• CVE-2025-61591 — Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution (CVSS 8.8)
• CVE-2025-61590 — Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection (CVSS 7.5)
• CVE-2025-61589 — Cursor: Potential Information Leakage via Mermaid Diagram (CVSS 5.9)
• CVE-2025-9190 — TCC Bypass via misconfigured Node fuses in Cursor (CVSS 4.8)
• CVE-2025-54135 — Cursor Agent is vulnerable to prompt injection via MCP Special Files (CVSS 9.8)
• CVE-2025-54130 — Cursor Agent is vulnerable prompt injection via Editor Special Files (CVSS 9.8)