CVE-2025-64107: 
NixOS vulnerability analysis and mitigation

CVE-2025-64107 affects Cursor, a code editor built for programming with AI, in versions 1.7.52 and below. The vulnerability was discovered and disclosed in November 2025. The issue involves a path manipulation vulnerability that could allow attackers to bypass sensitive file protection mechanisms on Windows systems (GitHub Advisory).

The vulnerability stems from incorrect path parsing based on the underlying platform. While Cursor correctly detects path manipulation attempts using forward slashes (./.cursor/./././././mcp.json) and requires human approval, it fails to properly detect similar manipulation using backslashes on Windows systems. This oversight in the security check implementation could allow an attacker to overwrite sensitive editor files without the required approval process. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability could lead to Remote Code Execution (RCE) on affected systems. However, the attack requires an attacker to have already achieved prompt injection or some other level of control. The impact is limited to Windows machines, where an attacker could potentially overwrite sensitive editor files without triggering the normal approval mechanisms (GitHub Advisory).

The vulnerability has been patched in Cursor version 2.0. Users are advised to upgrade to this version or later to protect against this security issue (GitHub Advisory).