Cursor IDE EUVD-2025-33199

Exploitation requires three concrete preconditions: (1) Cursor IDE at version 1.6.23 or below; (2) a case-insensitive filesystem - the default on Windows (NTFS) and macOS (APFS/HFS+), but NOT typical Linux ext4/xfs, which largely immunizes those hosts; and (3) the Cursor AI agent must process attacker-controlled content containing a prompt-injection payload (e.g., a malicious repository, source file, README/docs, or fetched web content). The injection then writes a case-variant of a protected path such as '.cursor/MCP.json', defeating Cursor's case-sensitive protection check (CWE-178) and causing arbitrary code execution via the tampered MCP configuration. Limiting factors: the victim must actually run the AI agent against the untrusted content, and the attack fails on case-sensitive filesystems, so the raw 9.8/AV:N/UI:N overstates reachability against hardened or Linux deployments.

Signals conflict sharply here. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score portray a trivially remote, unauthenticated, no-interaction RCE - but the description makes clear exploitation is gated on prompt injection, meaning the victim's Cursor AI agent must first ingest attacker-controlled content, and the bypass only works on case-insensitive filesystems (Windows/macOS defaults, not typical Linux ext4). The UI:N and arguably S:U metrics therefore understate the real preconditions; realistically this behaves like a user-interaction-dependent, environment-dependent flaw rather than a wormable network RCE. The exploitation-probability signals agree with this tempering: EPSS is only 0.14% (34th percentile), there is no CISA KEV listing, and no public exploit code is indicated - so despite the 9.8, this is not currently an active mass-exploitation priority. It remains a genuinely serious issue for developer endpoints because the outcome is full RCE and prompt-injection delivery via malicious repos/files/docs is a well-understood, low-friction vector, but it should be prioritized as a patch-promptly developer-tooling risk, not a drop-everything internet-facing emergency. Key caveat to verify: CVSS indicates network vector with no user interaction, yet the description implies the AI agent must process attacker content on a case-insensitive filesystem - treat the headline 9.8 as optimistic for AV/UI.

An attacker seeds a prompt-injection payload into content a developer's Cursor agent will read - e.g., a malicious open-source repository, a README, inline code comments, or fetched documentation. When the agent processes it, the injected instructions write to a case-variant of a protected path such as .cursor/MCP.json, slipping past Cursor's case-sensitive file-protection check on the victim's Windows or macOS (case-insensitive) filesystem, and the poisoned MCP configuration then yields remote code execution on the developer's host. No public exploit code is identified at time of analysis, but the prompt-injection delivery path is low-complexity.