Vulnerabilities in code written with Cursor

16 published CVEs and GitHub advisories where a change made with Cursor introduced the flaw, exposed the vulnerable path, or left a security fix incomplete, across 9 projects. Most common root cause: authentication & access control.

Findings: 16; 6% of all 284
Projects: 9; Most: mervinpraison/praisonai (4)
Critical or high: 3; of 7 with a severity score
Latest advisory: Aug 25, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

May 2025Peak advisory month: May 2026Sep 2026

By advisory publication month. The latest month is partial.

Root causes

What went wrong in findings that involve Cursor.

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Languages

Primary language of the affected repository.

All 16 findings

Newest first

AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
CVE-2026-79665Aug 25, 2026lin-snow/ech0GoCursorFlawed AI-written codeAuthentication & access control
n8n's personal-agent SearXNG fallback bypassed its configured SSRF policy. The repair injects the policy-aware web-search transport into the agent runtime and routes the SearXNG tool through the node request helper.
MediumCVE-2026-77085Aug 5, 2026n8n-io/n8nTypeScriptCursorFlawed AI-written codeSSRF & network boundaries
A coding agent with Codex 5.2 rewrote Gitea's repository-side public-only token gate into the TokenCanAccessRepo helper but kept the earlier human-written check that tested only for private repositories, so public-only tokens still reached limited-visibility owners' non-private repositories.
CVE-2026-56443Jul 21, 2026go-gitea/giteaGoCursorFlawed AI-written codeOther or unclear
AI-written code prefetched remote images using a single hostname validation before re-resolving DNS, allowing SSRF via DNS rebinding to internal resources.
CVE-2026-56676Jul 7, 2026decolua/9routerJavaScriptCursorFlawed AI-written codeSSRF & network boundaries
An AI-assisted trusted-proxy exception let fresh, unapproved Control UI devices retain client-requested scopes before server-side pairing approved them. The original device-less path cleared scopes and must be distinguished from the fresh-device path. Trusted-proxy authentication alone did not establish device privilege. An initial clamp removed unapproved scopes, a later change reintroduced the exception, and a subsequent pairing repair closed that recurrence. Source and published package provenance support discontinuous affected windows, without certifying every historical package or attributing the recurrence to AI.
GHSA-QJPC-QF9M-XWMRJul 2, 2026openclaw/openclawTypeScriptCursorDirect introductionAuthentication & access control
The missing owner checks already existed in human-written code; a commit co-authored by Cursor tried to harden project deletion with a guard keyed on lead_id, a field members could still rewrite to delete owner projects.
CVE-2026-61442Jun 25, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeAuthentication & access control
Cursor-assisted authentication code added an environment switch that skipped every credential check. On an externally reachable server configured with that switch, anyone could invoke registered agents without a token.
CVE-2026-57132Jun 18, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeInjection & unsafe execution
Claude Code wrote the restricted-builtins sandbox, but the vulnerable behavior already existed in earlier human-written code that ran with full builtins; the AI change left the dunder read open.
MediumCVE-2026-57120Jun 18, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeValidation & fail-open logic
AI-written verify_token() returned early when CALL_SERVER_TOKEN was unset, letting unauthenticated callers list, read, invoke, and unregister agents on the public server.
CVE-2026-47396May 29, 2026mervinpraison/praisonaiPythonCursorDirect introductionAuthentication & access control
A Claude Code-generated change introduced OSC 8 hyperlink rendering that inserts the raw session directory and origin remote URL into statusline escape sequences without sanitizing control bytes.
LowCVE-2026-47090May 18, 2026jarrodwatts/claude-hudTypeScriptCursorDirect introductionInjection & unsafe execution
Cursor-assisted XML validation checked a string view but forwarded the raw object. Stateful coercion could bypass the patch and restore prototype-pollution RCE.
CVE-2026-44791May 14, 2026n8n-io/n8nTypeScriptCursorFlawed AI-written codeInjection & unsafe execution
AI-written code compiled ICU Select options without validating property names, allowing inherited Object.prototype keys to bypass fallback and trigger a 500 DoS.
GHSA-R27J-894H-3W3PMay 6, 2026amannn/next-intlTypeScriptCursorDirect introductionResource abuse & availability
AI-written code bound the write-capable PUT /user endpoint to the read-only profile:read scope, letting an attacker with that token change an admin’s password and gain an unrestricted session.
HighCVE-2026-79673Apr 10, 2026lin-snow/Ech0GoCursorDirect introductionAuthentication & access control
AI-written code omitted scope checks on privileged admin routes, letting low-scope admin tokens access inbox and full database backup exports.
HighCVE-2026-79667Apr 9, 2026lin-snow/Ech0GoCursorFlawed AI-written codeAuthentication & access control
AI-generated panel endpoints omitted scope checks, letting minimal-scope tokens fully moderate comments and alter settings.
HighCVE-2026-79672Apr 9, 2026lin-snow/Ech0GoCursorDirect introductionAuthentication & access control
The Cursor co-authored change introduced the role-agnostic trusted-proxy Control UI bypass that let a client claiming role=node skip device identity and pairing.
MediumCVE-2026-32057Mar 3, 2026openclaw/openclawTypeScriptCursorDirect introductionAuthentication & access control