CoreCVE
Back

CRITICAL

ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json

Published Mar 1, 2025

Description

ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 1, 2025
Updated Mar 4, 2025
Reserved Mar 1, 2025
Link CVE-2025-27554
CISA Vulnrichment
Updated Mar 4, 2025
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2025-27554
Red Hat
Severity n/a
Public date n/a
Links CVE-2025-27554