CVE-2025-64110highCWE-284

CVE-2025-64110: fallo de gravedad alta en cursor

Cursor: Authentication Bypass Possible via New Cursorignore Write

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear cursor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.4%
Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones. This could allow a malicious agent to read protected files. This issue is fixed in version 2.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
cursor · cursor
CVEs relacionadas — cursor

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-54136HIGHCursor's Modification of MCP Server Definitions Bypasses Manual Re-approvalsEPSS 31.5%CVE-2025-54135HIGHCursor Agent is vulnerable to prompt injection via MCP Special FilesEPSS 2.1%CVE-2025-62354CRITICALCVE-2025-62354EPSS 1.3%CVE-2025-61591HIGHCursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code ExecutionEPSS 1.2%CVE-2026-50548CRITICALCursor Desktop sandbox escape via agent-controlled working directoryEPSS 1.0%CVE-2026-50549CRITICALCursor Desktop sandbox escape via symlink and failed path canonicalizationEPSS 1.0%