CVE-2025-54130 is a high severity (CVSS 7.5) flaw in the Cursor AI code editor. In versions before 1.3.9, a new dotfile such as .vscode/settings.json could be created without user approval, which an attacker could chain with prompt injection to run code. Cursor 1.3.9 fixes it.
What's affected
- Cursor versions below 1.3.9 are affected, per the record.
- Cursor 1.3.9 is the fixed version named in the advisory.
The record lists CVSS 7.5 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Open Cursor and check the version under the About dialog, or run the command line launcher if you installed it.
cursor --version
Anything below 1.3.9 needs an update. Also look in your workspaces for sensitive editor files such as .vscode/settings.json that you did not create yourself.
What to do now
- Update Cursor to 1.3.9 or later.
- Review workspace settings files, especially ones you do not remember creating.
- Treat content from untrusted repositories, web pages and issues as hostile input when an AI agent is reading it.
- Keep agent auto-run and approval settings strict until you are on a fixed build.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record describes the cause plainly. Editing an existing dotfile required approval, but creating a new one did not. If a sensitive file like the editor settings file was missing, an agent steered by injected instructions could create it and trigger code execution on the developer's machine.
The weakness class is incorrect authorization. The approval rule covered one case and missed the neighbouring one. For AI coding tools this matters more than usual, because the input that steers the agent can come from any file, page or ticket it reads.
Severity scores are a starting point. The score for this entry is 7.5, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does this need a user to approve anything?
Per the record, no. The point of the flaw is that the file write happened without the approval step.
Is it exploited in the wild?
The record does not flag it as a CISA KEV entry, and the advisory does not say it is. That is not proof it is safe, so update anyway.
Sources
Last reviewed: 18 October 2026.
