Cursor's own GHSA page: 3 more patched advisories from November 2025 this repo hadn't tracked (CVE-2025-64106, -64107, -64108)

TL;DR

A direct page-walk of github.com/cursor/cursor/security/advisories — the same practice this repo has used to catch prior undertracked Cursor and Claude Code GHSA entries — found three CVEs from a single November 2025 disclosure batch that had never surfaced in this repo's aggregator-focused search rotation: a Speedbump Modal Bypass in Cursor's MCP deep-link install flow (CVE-2025-64106), and two variants of the same sensitive-file-protection bypass on Windows — one via backslash path obfuscation (CVE-2025-64107), one via NTFS path quirks (CVE-2025-64108). All three are CVSS 8.8 (high), all fixed in Cursor 2.0, and all predate this repo's other tracked Cursor CVE clusters (DuneSlide, open-folder-autorun, GhostApproval, git.exe-autoexec, the July sandbox-escape batch, DeepJack/CursorJack).

What happened

Cursor's cursor:// MCP-install deeplink flow shows a "red alert" warning modal before installing an unfamiliar MCP server, intended to stop a user from unknowingly running an attacker-specified command. Insufficient input validation in the parsing logic that identifies "trusted" MCP servers (CWE-78, OS command injection class) let an attacker craft a deeplink that bypasses this warning entirely — a victim believing they're installing a well-known server (the advisory's own example: Playwright) instead silently runs the attacker's arbitrary command, with no visibility into what actually executed. Affected Cursor 1.7.28; fixed in 2.0. Reported by researcher yardenporat353.

This is an earlier, structurally different bug from the same general attack surface as DeepJack/CursorJack (which defeats a later fix, CVE-2025-54133, via dialog-truncation and nested-URI tricks rather than a trusted-server parsing bypass) — both show Cursor's MCP-install deeplink flow has needed multiple, independent rounds of fixing.

CVE-2025-64107 (GHSA-2jr2-8wf5-v6pf) — sensitive-file bypass via Windows backslash paths, CVSS 8.8

Cursor's sensitive-file protection (the guardrail requiring explicit human approval before an agent overwrites certain editor/config files) correctly detected path-obfuscation attempts using forward slashes, but not the equivalent technique using backslashes on Windows — letting an attacker who already controls agent output (via prompt injection or a malicious model) overwrite protected files without triggering the approval prompt. Affected 1.7.52; fixed in 2.0. Reported by researcher Philts. Must be chained with a prompt-injection or malicious-model foothold to reach exploitation — not independently exploitable from a clean session.

CVE-2025-64108 (GHSA-6r98-6qcw-rxrw) — sensitive-file bypass via NTFS path quirks, CVSS 8.8

A related but distinct bypass of the same sensitive-file protection: NTFS-specific path syntax (short (8.3) path names and alternate data streams) let an attacker's already-injected agent overwrite protected files, because path normalization for these NTFS-specific forms happened before the security guardrail's own path check ran. Affected 1.7.44; fixed in 2.0. Same reporter (Philts) as CVE-2025-64107, same chaining requirement (needs prompt injection or a malicious model as the entry point), same fix version.

All three were published on Cursor's own GitHub Security Advisories page on 2025-11-03 — nine months before this sweep found them via a direct index walk rather than search-engine queries, consistent with this repo's standing finding that vendor-only GHSA disclosures with no third-party aggregator pickup are systematically under-indexed by keyword search.

Am I affected?

cursor --version   # or Cursor > About Cursor in the app

All three are fixed in Cursor 2.0 and later — if you're on any version ≥ 2.0 (nearly certain if auto-update is on; Cursor is at 3.11+ as of this sweep), you are not exposed. If you're pinned to a pre-2.0 build for any reason, update immediately.

If you are affected

→ playbooks/if-your-local-ai-agent-was-exploited.md

Prevention

→ prevention/agent-sandboxing.md → prevention/mcp-hygiene.md — never click an unfamiliar MCP-install deeplink regardless of what server name it claims to install; a warning modal's presence isn't proof it can't be bypassed.

Why this matters for vibe coders

Two of these three bugs (CVE-2025-64107, CVE-2025-64108) are variations on the exact same theme — a security check that runs before platform-specific path normalization, so an attacker only needs to find one more OS-specific path quirk the check doesn't yet cover. Combined with this repo's other tracked Cursor sensitive-file and sandbox-escape clusters, the pattern holds: "sensitive file protection" and "sandbox" in Cursor are each a collection of individually-discovered, individually-patched edge cases rather than one structural guarantee — treat "patched" as "patched against the specific bypasses found so far."