CVE-2025-9190 in Cursor
Summary
by MITRE • 08/26/2025
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Cursor, potentially disguising attacker's malicious intent.
This issue was detected in 15.4.1 version of Cursor. Project maintainers decided not to fix this issue, because a scenario including a local attacker falls outside their defined threat model.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2025
The vulnerability described in CVE-2025-9190 represents a significant security flaw in the Cursor code editor application for macOS systems. This issue stems from the improper configuration of the RunAsNode fuse functionality within the application's security model. The flaw specifically affects version 15.4.1 of Cursor and demonstrates a critical oversight in how the application handles privilege escalation scenarios on macOS platforms. The vulnerability exists within the application's Transparency, Consent, and Control permissions system, which is fundamental to macOS security architecture and designed to protect users from unauthorized access to their system resources.
The technical implementation of this vulnerability exploits the RunAsNode fuse mechanism to create a privilege escalation vector that allows unprivileged local attackers to execute arbitrary code with elevated permissions. This occurs because the fuse configuration fails to properly enforce the security boundaries that should normally prevent such privilege escalation. The flaw specifically enables attackers to inherit existing TCC permissions that were previously granted to the Cursor application by the user. According to CWE-276, this represents a classic case of improper privilege management where the application fails to properly isolate its execution context from the underlying system security model. The vulnerability's exploitation mechanism aligns with ATT&CK technique T1068 which covers privilege escalation through legitimate system tools and services.
The operational impact of this vulnerability extends beyond simple code execution capabilities. Attackers can leverage this flaw to perform actions that would normally require explicit user consent through the TCC system, potentially enabling them to access sensitive user data, modify system files, or establish persistent access. The limitation that acquired resource access is restricted to previously granted permissions provides some mitigation but does not eliminate the risk entirely. This is particularly concerning because the TCC system is specifically designed to protect user privacy and prevent unauthorized access to sensitive system resources. The vulnerability creates a scenario where malicious actors can effectively bypass normal security controls while still operating within the bounds of previously granted permissions, making detection more difficult.
The decision by project maintainers not to address this vulnerability reflects a significant gap in their threat modeling approach. By excluding local attacker scenarios from their defined threat model, the maintainers have effectively accepted a security risk that could be exploited by adversaries with local system access. This decision contradicts standard security practices and industry best practices for application security. The vulnerability demonstrates the importance of comprehensive threat modeling that includes all potential attack vectors, including local privilege escalation scenarios. According to industry standards such as those outlined in NIST SP 800-30, threat models should consider all reasonable attack scenarios, including those that exploit local system vulnerabilities. The maintainers' approach essentially creates a false sense of security by ignoring legitimate threat vectors that could be exploited in real-world scenarios. Organizations deploying Cursor should be aware of this vulnerability and consider implementing additional security controls to mitigate the risk of exploitation by local attackers who may have already gained access to the system through other means.