Cyber Posture

CVE-2025-27554

Critical

Published: 01 March 2025

Published
01 March 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0058 69.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.

Security Summary

CVE-2025-27554 is a code injection vulnerability (CWE-94) in ToDesktop versions before 2024-10-03, a component used by Cursor before 2024-10-03 and other applications. It enables remote attackers to execute arbitrary commands on the build server—for instance, reading secrets from the desktopify config.prod.json file—and subsequently deploy updates to any app. This flaw stems from a postinstall script in package.json and carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and broad impact.

Attackers require only low privileges (PR:L) to exploit the vulnerability remotely without user interaction. Successful exploitation grants arbitrary command execution on the build server, allowing attackers to access sensitive configuration data and push malicious updates to affected applications, potentially compromising entire deployment pipelines.

Advisories and related posts, including ToDesktop's security incident report (https://www.todesktop.com/blog/posts/security-incident-at-todesktop), an analysis at https://kibty.town/blog/todesktop, and Hacker News discussion (https://news.ycombinator.com/item?id=43210858), detail the issue published on 2025-03-01. Mitigation involves updating to ToDesktop 2024-10-03 or later to address the postinstall script vulnerability.

No exploitation occurred in the wild.

Details

CWE(s)
CWE-94

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1195.002 Compromise Software Supply Chain Initial Access
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
attack.mitre.org →
Why these techniques?

Code injection (CWE-94) enables remote arbitrary command execution on the build server (T1190, T1059), directly facilitating supply chain compromise by deploying malicious updates to apps (T1195.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References