ByteOS Network

NVD Vulnerability Details :

CVE-2025-64108

Analyzed

Source-security-advisories@github.com

Published At-04 Nov, 2025 | 23:15

Updated At-10 Nov, 2025 | 18:38

Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent sensitive file protections and overwrite files which Cursor requires human approval to overwrite. Modification of some of the protected files can lead to RCE. Must be chained with a prompt injection or malicious model attach. Only affects systems supporting NTFS. This issue is fixed in version 2.0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

anysphere>>cursor>>Versions before 2.0(exclusive)

cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	security-advisories@github.com
CWE-94	Primary	security-advisories@github.com

CWE ID: CWE-22

Type: Primary

Source: security-advisories@github.com

CWE ID: CWE-94

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/cursor/cursor/security/advisories/GHSA-6r98-6qcw-rxrw	security-advisories@github.com	Vendor Advisory

Hyperlink: https://github.com/cursor/cursor/security/advisories/GHSA-6r98-6qcw-rxrw

Source: security-advisories@github.com

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History