CVE-2025-62354 CRITICAL

CVE-2025-62354

Vendor Cursor
Product cursor
Weakness CWE-78
Published November 26, 2025
Last update November 26, 2025

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.

Key dates

02Disclosure timeline

November 26, 2025 CVE published
November 26, 2025 Record updated