CVE-2025-59944 is a high severity (CVSS 8.0) flaw in the Cursor code editor, versions 1.6.23 and below. Case sensitive checks on protected files let prompt injection modify them on case insensitive file systems, leading to code execution. Upgrade to Cursor 1.7.
What's affected
Per the NVD record, Cursor versions 1.6.23 and below are affected and the fix is in version 1.7. The issue concerns the way the editor protects sensitive files, for example the .cursor/mcp.json configuration.
It matters most on case insensitive file systems, which are the default on macOS and Windows. The GitHub advisory page was not available through the API when I checked, so details come from the record.
How to check if you're exposed
Open Cursor and check the version under the About dialog. If it is 1.6.23 or lower, update.
Also review the MCP configuration for each project you use with the editor:
find . -iname "mcp.json" -path "*cursor*" 2>/dev/null
Read each file and confirm every server and command in it is one you added. Pay attention to repositories you cloned from others.
What to do now
- Update Cursor to 1.7 or later on every machine, including shared and build workstations.
- Review .cursor/mcp.json files in your projects and remove entries you do not recognise.
- Keep the editor's approval prompts for commands and file edits turned on.
- Be cautious about letting an agent read untrusted content, such as issues, web pages or third party files, in the same session as it can edit settings.
- Check your endpoint tooling reports the editor version so you can see stragglers.
Why it matters
The record maps this to CWE-178, improper handling of case sensitivity. The editor protects sensitive files by comparing path names in a way that distinguishes upper and lower case. On macOS and Windows, a path with different capitalisation still refers to the same file, so the protection could be skipped by writing to a differently capitalised name.
The chain in the record is prompt injection, then a modified configuration file, then code execution. Each step is ordinary alone, which is why defence has to be at the file protection layer as well as in the model. The vector shows user interaction is required and high attack complexity. It is not on the CISA KEV list, and the record has no exploitation information.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Cursor version fixes CVE-2025-59944?
Version 1.7, per the record.
Why does the file system matter?
On case insensitive file systems, differently capitalised paths point to the same file, which defeats a case sensitive protection check.
Sources
- GitHub advisory GHSA-xcwh-rrwj-gxc7 (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
