Critical RCE Vulnerability in Cursor AI Code Editor Fixed in Version 1.3

Researchers at Aim Labs have uncovered a critical security vulnerability in Cursor, an AI-powered code editor. The flaw, tracked as CVE-2025-54135 with a CVSS score of 8.6, allows for remote code execution (RCE) and has been dubbed CurXecute. This vulnerability poses a significant risk as it could enable attackers to execute arbitrary code on affected systems. The issue has been addressed in version 1.3 of Cursor, released on July 29, 2025. The technical implications of this vulnerability are severe. RCE vulnerabilities are particularly dangerous because they can lead to complete system compromise. Given that Cursor is used by developers, an exploit could potentially lead to compromised development environments and even supply chain attacks if malicious code is introduced into projects. The high CVSS score indicates that the vulnerability is easy to exploit and has a substantial impact on confidentiality, integrity, and availability. For cybersecurity professionals, the immediate action is to ensure that all instances of Cursor are updated to version 1.3 or later. Organizations should also review any projects developed using vulnerable versions of Cursor for signs of tampering. Additionally, network monitoring should be enhanced to detect any unusual activity that might indicate exploitation of this vulnerability. This incident underscores the importance of regular software updates and robust vulnerability management practices, especially for tools used in development environments. Developers and organizations must remain vigilant and proactive in applying security patches to mitigate such risks.