Case cursor-curxecute-mcpoisonAgent hijackUnited States
CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution
Aim Security (CVE-2025-54135) and Check Point (CVE-2025-54136) showed prompt injection could write a .cursor/mcp.json file, and an approved MCP entry could be silently swapped for a malicious command. Fixed in 1.3.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 1, 2025
- Location
- United States
- Target
- Cursor AI code editor
- Severity
- High
- Triggered by
- Aim Security and Check Point Research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-54135, CVE-2025-54136
What happened
Aim Security (CVE-2025-54135) and Check Point (CVE-2025-54136) showed prompt injection could write a .cursor/mcp.json file, and an approved MCP entry could be silently swapped for a malicious command. Fixed in 1.3.
Impact: Remote and persistent code execution on developer machines; no in-the-wild exploitation reported
Who triggered it
Actor: Aim Security and Check Point Research
Attribution: Two independent responsible disclosures reported to Cursor on July 7 and July 16, 2025
Motive: Security research
How it happened
Attack vector: Prompt injection via a Slack MCP message creating an MCP config that auto-executes; and editing a trusted mcp.json in a shared repo so the approved entry runs a new command without re-prompting
Root cause: Cursor wrote in-workspace files without approval and trusted MCP configurations by name rather than by content
Timeline
- Aim Security reports CurXecute to Cursor
- Check Point reports MCPoison
- Cursor 1.3 released with fixes
- Public disclosure of both vulnerabilities
Response
Cursor patched both issues in version 1.3 and now re-prompts when MCP configuration changes
Current status: Patched
Sources (open in a new tab)
- Tenable tenable.com
- The Hacker News thehackernews.com
- Tenable CVE entry tenable.com
Cite this case
CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution. AI Threat Watch, case cursor-curxecute-mcpoison, Aug 1, 2025. https://aithreat.io/cases/cursor-curxecute-mcpoison/
Permanent link: https://aithreat.io/cases/cursor-curxecute-mcpoison/