CVE-2025-9190

Executive Summary

CVE-2025-9190 is a local privilege escalation vulnerability in Cursor for macOS (version 15.4.1) that exploits the "RunAsNode" fuse configuration. A local unprivileged attacker can execute arbitrary code that inherits Cursor's TCC (Transparency, Consent, and Control) permissions, allowing unauthorized access to previously granted resources (e.g., camera, microphone, files). The vendor has declined to fix this issue, citing that a local attacker scenario is outside their threat model.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a macOS-specific desktop application issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Attacker needs unprivileged access.
• User Interaction (UI): None (N) – No user action required beyond initial TCC grant.
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality (C): Low (L) – Limited to previously granted TCC permissions.
• Integrity (I): Low (L) – Attacker can execute code but not modify system files.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 4.4 (Medium)

Threat Level: Medium – Exploitation requires local access but is trivial once achieved.

Deep Dive & Mechanics

The vulnerability stems from Cursor's "RunAsNode" fuse being enabled. On macOS, TCC permissions are tied to the application bundle. When Cursor is launched with RunAsNode, it allows Node.js child processes to inherit the parent's TCC permissions without additional prompts. A local attacker can craft a malicious script that, when executed via Cursor's Node.js runtime, accesses resources (e.g., files, camera) that the user previously granted to Cursor. The attacker's code runs under Cursor's identity, so TCC prompts appear as if Cursor is requesting access, potentially tricking the user.

Key Technical Details:

• RunAsNode Fuse: A macOS feature that allows an application to run as a Node.js process, inheriting its parent's entitlements.
• TCC Bypass: The attacker does not need to bypass TCC entirely; they inherit existing permissions.
• Attack Vector: Local unprivileged user executes a script that spawns a child process under Cursor's context.

Vulnerable vs. Patched Code

Vulnerable Code (Cursor 15.4.1):

• The RunAsNode fuse is enabled by default.
• No restrictions on child process creation or permission inheritance.

Patched Code (Not Available):

• The vendor has not released a patch. A hypothetical fix would disable RunAsNode or restrict child process TCC inheritance.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local unprivileged access to a macOS system with Cursor 15.4.1 installed.
• User has granted Cursor TCC permissions (e.g., camera, microphone, files).

Exploit Steps:

1. Identify Cursor's process ID (PID) using ps aux | grep Cursor.
2. Create a malicious Node.js script that accesses a protected resource (e.g., fs.readFileSync('/Users/user/Documents/secret.txt')).
3. Execute the script using Cursor's Node.js runtime:

   /Applications/Cursor.app/Contents/Resources/app/node /path/to/malicious.js
   

4. The script inherits Cursor's TCC permissions and accesses the resource without prompting the user.

Example Malicious Script:

const fs = require('fs');
const data = fs.readFileSync('/Users/user/Documents/secret.txt', 'utf8');
console.log(data);

Blue Team

Detection:

• Monitor for child processes spawned by Cursor that are not typical (e.g., node processes with unusual arguments).
• Use endpoint detection and response (EDR) to flag TCC permission inheritance anomalies.

Mitigation:

• Restrict local access to the system (e.g., enforce least privilege).
• Monitor TCC database changes using tccutil or sqlite3 on ~/Library/Application Support/com.apple.TCC/TCC.db.

Indicators of Compromise (IOCs)

• Process: node spawned by Cursor with unusual arguments (e.g., reading sensitive files).
• File Access: Unauthorized access to files in ~/Documents, ~/Desktop, etc., via Cursor's PID.
• TCC Database: Entries in TCC.db showing Cursor accessing resources without user interaction.

Detection Engineering

YARA Rule

rule CVE_2025_9190_Cursor_TCC_Bypass {
    meta:
        description = "Detects malicious Node.js scripts exploiting Cursor TCC bypass"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-9190"
    strings:
        $s1 = "fs.readFileSync" ascii wide nocase
        $s2 = "process.binding" ascii wide nocase
        $s3 = "child_process" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Cursor TCC Permission Inheritance Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects child processes spawned by Cursor that may inherit TCC permissions
author: Valters IT
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith: '/Cursor.app/Contents/MacOS/Cursor'
        Image|endswith: '/node'
    condition: selection
falsepositives:
    - Legitimate Node.js scripts run by the user
level: medium

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-9190 Cursor TCC Bypass"; content:"Cursor"; offset:0; depth:6; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable RunAsNode: If possible, modify Cursor's configuration to disable the RunAsNode fuse (not officially supported).
2. Restrict Local Access: Implement strict user access controls on macOS (e.g., disable guest accounts, enforce password policies).
3. Monitor TCC Permissions: Regularly audit TCC database for unexpected entries.

Long-Term Recommendations:

• Vendor Action: Advocate for Cursor to patch this issue by disabling RunAsNode or implementing permission inheritance restrictions.
• User Education: Warn users about the risks of granting TCC permissions to applications that run Node.js scripts.

Workaround:

• Use a different code editor that does not have this vulnerability (e.g., VS Code with proper sandboxing).

Valters IT