- Description
- Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- cursor
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-78
- Hype score
- Not currently trending
[CVE-2025-64106: HIGH] ⚠️ Attention: A security flaw in Cursor code editor versions 1.7.28 and below allows crafted deep-links to bypass security warnings, executing hidden commands. Update now to stay secure.#cve,CVE-2025-64106,#cybersecurity https://t.co/BCiej5Pjxk https://
@CveFindCom
5 Nov 2025
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
**CVE-2025-64106** pertains to an input validation flaw within the MCP (My Command Protocol) server component of the Cursor code editor, specifically affecting versions **1.7.28 and earlier**. The bug allows attackers to craft malicious deep-links that bypass typical security
@CveTodo
4 Nov 2025
49 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-64106 Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially cr… https://t.co/ooqC7EVez8
@CVEnew
4 Nov 2025
359 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "630DF821-F0CF-4B9C-BC9F-EB7B9FD9E4C3",
"versionEndExcluding": "2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]