CVE-2025-64110: Cursor Information Disclosure Vulnerability

CVE-2025-64110 Overview

CVE-2025-64110 is a security vulnerability in Cursor, a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via the cursorignore configuration mechanism. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones. This could allow a malicious agent to read protected files, potentially exposing sensitive credentials, API keys, and proprietary source code.

Critical Impact

Malicious AI agents or attackers with prompt injection access can bypass file protection mechanisms to read sensitive files that should be restricted via cursorignore configuration.

Affected Products

• Anysphere Cursor versions 1.7.23 and below
• All platforms running vulnerable Cursor installations
• Environments using cursorignore for file protection

Discovery Timeline

• 2025-11-05 - CVE CVE-2025-64110 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-64110

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating a fundamental flaw in how the Cursor application handles access control decisions for protected files. The logic bug resides in how Cursor processes multiple cursorignore configuration files within a project hierarchy.

The vulnerability enables a form of configuration hijacking where a newly created cursorignore file can override or invalidate existing protection rules. This is particularly dangerous in the context of AI-assisted coding environments, where the AI agent operates with elevated file system access permissions. When an attacker achieves prompt injection—a technique where malicious instructions are embedded in AI prompts—they can manipulate the AI agent to create strategically placed cursorignore files that neutralize existing protections.

The attack requires network access and can be exploited without user interaction. Once the configuration bypass is achieved, the attacker gains unauthorized read access to files that were explicitly protected, such as .env files containing secrets, private keys, configuration files with database credentials, or proprietary source code marked as confidential.

Root Cause

The root cause stems from improper access control logic in the cursorignore file processing mechanism. Specifically, the application fails to properly validate and prioritize multiple cursorignore configurations within a directory hierarchy. When a new cursorignore file is created, it can unexpectedly override the rules defined in parent or existing configuration files, rather than properly merging or respecting the most restrictive policies. This logic flaw allows an attacker to essentially "reset" the file protection rules by introducing a malicious configuration file.

Attack Vector

The attack vector is network-based and exploits the trust relationship between the user and the AI coding assistant. An attacker first needs to achieve prompt injection—either through crafted code comments, malicious repository content, or compromised model behavior. Once prompt injection is established, the attacker instructs the AI agent to:

1. Create a new cursorignore file in a strategic location within the project
2. The newly created configuration invalidates pre-existing protection rules
3. The AI agent can now read previously protected sensitive files
4. Sensitive data is exfiltrated through the AI's response mechanism

This attack chain leverages the inherent capabilities of AI coding assistants, which typically have broad file system access to provide helpful code suggestions and assistance.

Detection Methods for CVE-2025-64110

Indicators of Compromise

• Unexpected creation or modification of cursorignore files in project directories
• AI agent accessing files that should be protected by existing ignore rules
• Unusual patterns of file read operations targeting sensitive configuration files
• Evidence of prompt injection attempts in AI conversation logs

Detection Strategies

• Monitor file system events for creation or modification of cursorignore files, especially in subdirectories
• Implement audit logging for AI agent file access operations and compare against expected ignore rules
• Review AI interaction logs for suspicious prompts that attempt to manipulate file access behavior
• Deploy file integrity monitoring on critical configuration files including all cursorignore files

Monitoring Recommendations

• Enable verbose logging for Cursor application file operations
• Set up alerts for any modifications to cursorignore files across monitored repositories
• Regularly audit AI agent access patterns to identify unauthorized file reads
• Monitor for known prompt injection patterns in AI conversation inputs

How to Mitigate CVE-2025-64110

Immediate Actions Required

• Upgrade Cursor to version 2.0 or later immediately
• Audit all cursorignore files in active projects for unexpected modifications
• Review recent AI interactions for signs of prompt injection or unauthorized file access
• Consider temporarily restricting AI agent file system access until patched

Patch Information

Anysphere has released version 2.0 of Cursor which addresses this vulnerability. The fix corrects the logic bug in how cursorignore configuration files are processed, ensuring that protection rules cannot be invalidated by newly created configuration files. Users should update to version 2.0 or later through the standard Cursor update mechanism. For detailed information, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, manually lock cursorignore file permissions to prevent AI agent modification
• Implement additional file system access controls to protect sensitive files independent of Cursor's ignore mechanism
• Consider using operating system-level access controls or encrypted file containers for highly sensitive data
• Disable or restrict AI agent capabilities that allow file creation until the patch can be applied

# Example: Protect cursorignore files from modification
chmod 444 .cursorignore
chattr +i .cursorignore  # Linux immutable attribute