Arbitrary code execution from Cursor Agent through a prompt injection via Editor Special Files

High7.5CVE-2025-54130 · Published Aug 2, 2025

### Summary Cursor allows writing in-workspace files with no user approval. If the file is a dotfile, editing it requires approval but creating one if it doesn't exists doesn't. Hence, if sensitive editor files, such as the `.vscode/settings.json` file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. ### Impact If chained with a separate prompt injection vulnerability, this could allow the writing of sensitive editor files on the host by the agent. This can then be used to indirectly execute code , e.g. by changing the user's default shell. ### Remediation The agent has been blocked from writing several editor-sensitive files without approval.