CVE-2025-27554

CRITICAL EPSS 50.0%

Published Mar 1, 20251y ago · Modified Jun 17, 20262w ago

9.9 CVSS 3.1

Critical

Published Mar 1, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred.

CVSS Details

Base Score

9.9

Exploitability

3.1

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

50.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

References 3

kibty.town https://kibty.town/blog/todesktop
news.ycombinator.com https://news.ycombinator.com/item?id=43210858
todesktop.com https://www.todesktop.com/blog/posts/security-incident-at-todesktop

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.