CVE-2025-54130
Last modified
CVE-2025-54130 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Anysphere | Cursor | < 1.3.9 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54130?
How severe is CVE-2025-54130?
How do I fix CVE-2025-54130?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54124XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54125XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54126The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.3
- CVE-2025-54127HAXcms with nodejs backend allows users to start the server …9.8
- CVE-2025-54128HAX CMS NodeJs allows users to manage their microsite univer…6.1
- CVE-2025-54129HAXiam is a packaging wrapper for HAXcms which allows anyone…4.3
- CVE-2025-54131Cursor is a code editor built for programming with AI. In ve…8.8
- CVE-2025-54132Cursor is a code editor built for programming with AI. In ve…7.5
- CVE-2025-54133Cursor is a code editor built for programming with AI. In ve…9.6
- CVE-2025-54134HAX CMS NodeJs allows users to manage their microsite univer…6.5
- CVE-2025-54135Cursor is a code editor built for programming with AI. Curso…9.8
- CVE-2025-54136Cursor is a code editor built for programming with AI. In ve…8.8
Are you affected by CVE-2025-54130?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST