Cursor CLI Project Config RCE
Date: 2025-10
Affected: Cursor CLI Project Config RCE
Attack vector: rce
Category: real-world
Severity: High
CVE: CVE-2025-61592
CVE-2025-61593
CWE: CWE-178
CWE-829
CWE-94
CVSS:  (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)

Cloned projects with `.cursor/cli.json` could override global config, allowing attacker-controlled commands to execute via Cursor CLI context.


Mitigations:

Architectural layers (MAESTRO):