Cursor MCP Config Prompt-Injection RCE (CurXecute)

aka CurXecute

Product: Anysphere Cursor
CVE: CVE-2025-54135
Disclosed: 2025-08-01
CVSS: 8.6
Auth: pre-auth
CISA KEV: no
Affected: Cursor < 1.3.9
Fixed: 1.3.9

Summary

Aim Labs showed that a prompt injection, for example in a Slack message read via MCP, could make Cursor's agent create a new .cursor/mcp.json file. Cursor immediately started the MCP server defined there, running attacker commands with no user approval.

Root cause

Cursor required approval to edit existing dotfiles but not to create new ones, and it auto-started MCP servers as soon as mcp.json changed. An indirect prompt injection could therefore have the agent write a new MCP config whose 'command' is an arbitrary shell command, which executed before the user could reject the suggested edit.

Impact

Remote code execution on the developer's machine with the user's privileges, triggered by untrusted content the agent reads.

Detection

Monitor creation of .cursor/mcp.json in workspaces and unexpected child processes of Cursor; version check < 1.3.9.

Mitigation