CVE-2025-61592: Anysphere Cursor RCE Vulnerability

CVE-2025-61592 Overview

CVE-2025-61592 is a Remote Code Execution vulnerability affecting Cursor, an AI-powered code editor developed by Anysphere. The vulnerability exists in versions 1.7 and below, where automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configurations in the Cursor CLI. This flaw enables attackers to achieve Remote Code Execution through a combination of permissive configuration settings that allow shell commands and prompt injection delivered via project-specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms.

Critical Impact

Users who clone and open malicious repositories in Cursor versions 1.7 and below are vulnerable to Remote Code Execution through crafted project configuration files that can override global security settings and execute arbitrary shell commands.

Affected Products

• Anysphere Cursor versions 1.7 and below
• Cursor CLI with project-specific configuration loading enabled
• Development environments using .cursor/cli.json and .cursor/rules/ configurations

Discovery Timeline

• October 3, 2025 - CVE-2025-61592 published to NVD
• October 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-61592

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), highlighting a fundamental trust boundary violation in how Cursor handles project-level configurations. The core issue stems from the CLI's willingness to automatically load and apply configuration overrides from untrusted project directories without adequate validation or user consent.

The attack surface is particularly concerning given Cursor's AI-assisted development workflow. Developers routinely clone repositories from various sources to review code, contribute to open-source projects, or evaluate third-party libraries. By embedding malicious configuration files within a repository, an attacker can weaponize this common development practice.

The exploitation requires user interaction—specifically, the victim must open a malicious repository in Cursor. However, given the frequency with which developers clone and explore repositories, this represents a realistic and practical attack scenario. The vulnerability enables complete compromise of the development environment with the privileges of the running user.

Root Cause

The root cause lies in insufficient trust boundary enforcement when processing project-specific CLI configuration files. The Cursor CLI automatically loads configuration from <project>/.cursor/cli.json without adequately restricting which settings can be overridden or validating the security implications of those overrides. This permissive configuration loading, combined with support for shell command execution and the Rules system (<project>/.cursor/rules/rule.mdc), creates a chain that allows untrusted project files to execute arbitrary code.

Attack Vector

The attack leverages network-based delivery through malicious repositories. An attacker crafts a repository containing specially designed configuration files in the .cursor/ directory. When a victim clones this repository and opens it with Cursor, the CLI automatically loads the malicious configuration which can:

1. Override global security configurations that normally restrict shell command execution
2. Inject malicious prompts through the Rules system that leverage AI capabilities to execute commands
3. Chain these capabilities together to achieve arbitrary code execution on the victim's system

The vulnerability mechanism relies on the automatic configuration loading behavior of the Cursor CLI. When a user opens a project directory, Cursor searches for and loads .cursor/cli.json without prompting the user or validating the security implications of the configuration directives. The permissive nature of these overrides allows attackers to enable dangerous capabilities that may be disabled in global settings. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-61592

Indicators of Compromise

• Presence of unexpected .cursor/cli.json files in recently cloned repositories with shell command configurations
• Unusual .cursor/rules/rule.mdc files containing suspicious prompt injection patterns
• Unexpected child processes spawned by the Cursor application
• Anomalous network connections originating from the Cursor process

Detection Strategies

• Monitor file system activity for creation or modification of .cursor/cli.json and .cursor/rules/ files in project directories
• Implement endpoint detection rules to flag shell command execution originating from Cursor's process tree
• Review repository contents before opening in Cursor, particularly the .cursor/ directory structure
• Deploy application allowlisting to restrict unexpected executables launched by development tools

Monitoring Recommendations

• Enable process creation logging to track child processes spawned by Cursor
• Configure file integrity monitoring on development workstations to alert on .cursor/ directory modifications
• Implement network monitoring for unusual outbound connections from development environments
• Establish baseline behavior profiles for Cursor application to detect anomalous activity

How to Mitigate CVE-2025-61592

Immediate Actions Required

• Update Cursor to patch version 2025.09.17-25b418f or later
• Audit existing repositories for suspicious .cursor/cli.json and .cursor/rules/ files before opening
• Review recently cloned repositories from untrusted sources for malicious configuration files
• Consider restricting Cursor's ability to execute shell commands in organizational security policies

Patch Information

Anysphere has released patch 2025.09.17-25b418f to address this vulnerability. As of October 3, 2025, this fix is available as a patch but has not yet been incorporated into an official release version. Users should apply the patch immediately or monitor for the next release version that includes this fix. For the latest security information, consult the GitHub Security Advisory.

Workarounds

• Manually inspect .cursor/ directories in cloned repositories before opening projects in Cursor
• Remove or rename suspicious .cursor/cli.json and .cursor/rules/ files from untrusted repositories
• Use sandboxed environments or containers when evaluating code from untrusted sources
• Disable automatic project configuration loading if the option becomes available in settings

# Configuration example - Inspect suspicious Cursor configuration files before opening repositories
# Check for potentially malicious configuration in cloned repositories
find /path/to/repository -name "cli.json" -path "*/.cursor/*" -exec cat {} \;
find /path/to/repository -name "*.mdc" -path "*/.cursor/rules/*" -exec cat {} \;

# Remove suspicious configuration files if found
rm -rf /path/to/repository/.cursor/