CVE-2025-9190 (CNNVD-202508-3104)
中文标题:
Cursor 安全漏洞
英文标题:
TCC Bypass via misconfigured Node fuses in Cursor
漏洞描述
中文描述:
Cursor是Cursor开源的一个 AI 代码编辑器。 Cursor 15.4.1版本存在安全漏洞，该漏洞源于RunAsNode配置不当，可能导致本地攻击者执行任意代码。
英文描述:
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Cursor, potentially disguising attacker's malicious intent. This issue was detected in 15.4.1 version of Cursor. Project maintainers decided not to fix this issue, because a scenario including a local attacker falls outside their defined threat model.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cursor | Cursor | 15.4.1 | - | - |
cpe:2.3:a:cursor:cursor:15.4.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-9190 |
2025-11-11 15:23:38 | 2025-11-11 07:40:54 |
| NVD | nvd_CVE-2025-9190 |
2025-11-11 15:01:00 | 2025-11-11 07:48:40 |
| CNNVD | cnnvd_CNNVD-202508-3104 |
2025-11-11 15:12:55 | 2025-11-11 08:00:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-3104
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']