Cybersecurity researchers have disclosed a now-patched, high-severity safety flaw in Cursor, a preferred synthetic intelligence (AI) code editor, that might end in distant code execution.
The vulnerability, tracked as CVE-2025-54135 (CVSS rating: 8.6), has been addressed in model 1.3 launched on July 29, 2025. It has been codenamed CurXecute by Intention Labs, which beforehand disclosed EchoLeak.
Cursor AI Code Editor Mounted Flaw Permitting Attackers to Run Instructions by way of Immediate Injection
