2025 Cursor AI Code Editor Vulnerability: Supply-Chain Risk via Malicious Repositories
Executive Summary
In September 2025, a security flaw was disclosed affecting Cursor, an AI-powered code editor, that allowed silent code execution when users opened repositories embedded with malicious payloads. The vulnerability stemmed from a default-disabled security setting, letting attackers execute arbitrary code on victim machines under their own user privileges. Security researchers highlighted the risk of potential supply-chain attacks, as any developer opening a tampered repository could unwittingly trigger the exploit, potentially leading to credential theft, system compromise, or further lateral movement within organizational networks. The impact was amplified by Cursor's AI-driven capabilities and its popularity in modern development environments.
This incident spotlights the growing risks at the intersection of AI-driven tools and software supply chains. With more organizations relying on smart code editors and automated workflows, attackers are increasing their focus on weaknesses in tool defaults and developer behaviors, driving regulatory concern and heightening the urgency for robust code execution safeguards.
Why This Matters Now
As AI-powered developer tools become commonplace, insecure defaults and supply-chain vectors can introduce severe unseen risks. This incident underscores the urgency for organizations to review and harden tool configurations to counter novel attack techniques that capitalize on automation and developer workflow habits.
Attack Path Analysis
The attacker introduces a maliciously crafted repository and waits for a victim to open it with the vulnerable Cursor AI code editor, which by default allows unintended code execution. Once code runs, the adversary may attempt to escalate privileges on the victim's workstation. Next, lateral movement could occur if the initial endpoint has access to other internal cloud or local resources. The attacker would establish persistent outbound command and control to a remote server, potentially over encrypted or covert channels. Sensitive data could then be exfiltrated through permitted outbound paths. Ultimately, the attacker may deliver further payloads resulting in data loss, disruption, or further compromise.
Kill Chain Progression
Initial Compromise
Description
Attacker leverages the supply-chain vulnerability by delivering a malicious repository that, when opened in Cursor AI, causes silent code execution under the user's privileges.
Related CVEs
CVE-2025-54135
CVSS 8.6An indirect prompt injection vulnerability in Cursor AI allows attackers to create and execute MCP files without user confirmation, leading to remote code execution.
Affected Products:
Anysphere Cursor – < 1.3
Exploit Status:
proof of conceptCVE-2025-54136
CVSS 7.2A vulnerability in Cursor AI allows attackers to stealthily modify MCP configurations, leading to remote code execution without user knowledge.
Affected Products:
Anysphere Cursor – < 1.3
Exploit Status:
proof of conceptCVE-2025-61590
CVSS 8Cursor AI is vulnerable to remote code execution via .code-workspace files using prompt injection.
Affected Products:
Anysphere Cursor – <= 1.6
Exploit Status:
proof of conceptCVE-2025-54131
CVSS 7.5Cursor AI bypasses its allow list to execute arbitrary commands, leading to potential remote code execution.
Affected Products:
Anysphere Cursor – < 1.3
Exploit Status:
proof of conceptCVE-2025-61592
CVSS 7.8Cursor CLI allows arbitrary code execution through permissive CLI configuration, leading to potential remote code execution.
Affected Products:
Anysphere Cursor – <= 1.7
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
User Execution: Malicious File
Command and Scripting Interpreter
Valid Accounts
System Services: Service Execution
Create or Modify System Process: Windows Service
Ingress Tool Transfer
Impair Defenses: Disable or Modify Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure Security of Custom and Third-Party Software
Control ID: 6.2.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 6
CISA Zero Trust Maturity Model 2.0 – Software Supply Chain Security Controls
Control ID: Asset Management
NIS2 Directive – Security of Network and Information Systems
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical supply-chain vulnerability in AI-powered Cursor editor exposes software developers to arbitrary code execution risks when opening malicious repositories.
Information Technology/IT
IT organizations face heightened supply-chain attack vectors through compromised development tools, requiring enhanced zero trust segmentation and threat detection capabilities.
Financial Services
Banking and financial institutions using AI development tools vulnerable to code injection attacks, threatening compliance frameworks and sensitive data protection.
Health Care / Life Sciences
Healthcare technology development compromised by malicious code execution vulnerabilities, risking HIPAA compliance and patient data security through supply-chain attacks.
Sources
- Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositorieshttps://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.htmlVerified
- Several Vulnerabilities Patched in AI Code Editor Cursorhttps://www.securityweek.com/several-vulnerabilities-patched-in-ai-code-editor-cursor/Verified
- Cursor 'Open-Folder' Autorun Vulnerability Exposes Developers to Silent Code Executionhttps://www.oasis.security/blog/cursor-security-flawVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Comprehensive zero trust controls—including microsegmentation, egress policy enforcement, intrusion prevention, threat detection, and traffic encryption—would have limited each stage by isolating workloads, monitoring traffic, and preventing unauthorized code execution from propagating laterally or exfiltrating data.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection and alerting on abnormal process or network activity from user endpoints.
Control: Zero Trust Segmentation
Mitigation: Limits attacker access scope via least privilege policies and identity-based segmentation.
Control: East-West Traffic Security
Mitigation: Detects or blocks unauthorized workload-to-workload or service-to-service connections.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks or monitors suspicious outbound communication to attacker-controlled infrastructure.
Control: Cloud Firewall (ACF)
Mitigation: Inspects and blocks data exfiltration attempts over monitored outbound ports and URLs.
Real-time inspection and distributed policy enforcement block or limit destructive actions.
Impact at a Glance
Affected Business Functions
- Software Development
- Code Review
- Continuous Integration
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive credentials, intellectual property, and unauthorized access to development environments.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce zero trust segmentation to restrict lateral movement between internal workloads and user environments.
- • Implement strict egress filtering, FQDN controls, and outbound firewall policies to prevent unauthorized data exfiltration and attacker C2.
- • Deploy anomaly detection and threat intelligence solutions to rapidly identify suspicious code execution or user behavior.
- • Apply least privilege and identity-based policies, leveraging microsegmentation for all sensitive workloads.
- • Regularly review and update network and application posture via centralized, multi-cloud visibility and policy automation.
