Cursor CLI Agent CVE-2025-61593

Exploitation requires a developer to run the Cursor CLI Agent (version 1.7 or below) against attacker-influenced content, allowing prompt injection to overwrite the agent's trusted configuration file at */.cursor/cli.json. The RCE path is further gated on a case-insensitive filesystem - present by default on macOS and Windows but generally NOT on Linux - which both broadens exposure on the former and limits it on the latter. Limiting factors: mandatory user interaction (the victim must actively invoke the agent on the malicious input), the version ceiling (≤1.7), and the filesystem-case dependency. No specially privileged account is needed beyond the developer's own session.

Signals are mixed and lean toward moderate real-world priority despite the HIGH 8.8 base score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, unauthenticated code-injection flaw with full C/I/A impact, which drives the high score, but the UI:R flag is decisive: exploitation is not autonomous - a developer must actually run the Cursor CLI Agent against attacker-controlled content for the prompt injection to fire. EPSS is low at 0.12% (31st percentile), the vulnerability is NOT in CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or at-scale exploitation. The description also adds a material precondition absent from the CVSS vector - the RCE path depends on a case-insensitive filesystem (default on macOS and Windows, but not typical Linux) - which the AC:L rating does not reflect; a stricter reading could justify AC:H. No SSVC decision data was provided. Net: a credible, vendor-acknowledged (GitHub Security Advisory) code-execution bug worth patching on developer workstations, but the low EPSS, absence of KEV/POC, and the required user action argue against treating it as an emergency relative to its 8.8 label.

An attacker plants a prompt-injection payload in content a developer will feed to the Cursor CLI Agent (e.g., a repository file, issue, or document). When the developer runs the agent on it, the injected instructions cause the agent to overwrite the trusted */.cursor/cli.json configuration, and on a case-insensitive filesystem the tampered config is loaded and executes attacker-chosen commands as the developer. No public exploit code was identified at time of analysis.