Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M
CVE-2025-64110Cursor: Authentication Bypass Possible via New Cursorignore Write
High 8.7
In plain English
A high-severity improper access control in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones. This could allow a malicious agent to read protected files. This issue is fixed in version 2.0.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/cursor/cursor/security/advisories/GHSA-vhc2-fjv4-wqch x_refsource_CONFIRM