CVE-2025-62354

Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2025-11-26

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/

Check your stackJSON