EUVD-2025-33205Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Full system compromise — the attacker can execute any command with the privileges of the vulnerable application process. With a CVSS score of 8.8 (HIGH), this represents a significant risk. |
| Exploit ScenarioDerived | An attacker injects shell metacharacters (;, |, &&) into a parameter that is passed to a system command, causing additional commands to be executed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious MCP server and return crafted, maliciously injected commands during the interaction process, leading to command injection and potential remote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow arbitrary code execution on the host by the agent. This can then be used to directly compromise the system by executing malicious commands with full user privileges. This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.
Earlier versions of this analysis (1)
RemediationAI
Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).
Know when Cursor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Executive ViewAI
Organizations using Cursor face significant risk from CVE-2025-61591, a OS command injection vulnerability rated CVSS 8.8. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary code execution in Cursor for Windows 3.2.16 lets remote attackers run code on a developer's machine by plantin
Remote code execution in Cursor IDE 1.6.23 and below can be triggered by prompt injection that abuses case-insensitive p
Cursor AI code editor before 2.3 allows prompt injection to bypass the Agent's Allowlist mode. Shell built-ins can execu
Sandbox escape leading to non-sandboxed remote code execution in Cursor (the AI code editor) prior to version 3.0, where
Sandbox escape leading to non-sandboxed remote code execution affects the Cursor AI code editor prior to version 3.0, wh
Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific
Remote code execution in Cursor CLI Agent 1.7 and earlier can be triggered by unauthenticated attackers through prompt i
Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Cursor is a code editor built for programming with AI. versions up to 2.0 is affected by os command injection.
Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.7), this vulnerability is remotely ex
Exploit-DB