CVE-2025-54135

critical

Description

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.

From the Tenable Blog

Cursor AI Code Editor vulnerabilities CurXecute and MCPoison | Tenable®

Published: 2025-08-06

Cursor AI Editor is vulnerable to code execution via two flaws in how it handles MCP servers named "CurXecute" and "MCPoison."

https://www.darkreading.com/vulnerabilities-threats/rce-flaw-ai-coding-tool-supply-chain-risk

https://www.securityweek.com/several-vulnerabilities-patched-in-ai-code-editor-cursor/

https://www.bleepingcomputer.com/news/security/ai-powered-cursor-ide-vulnerable-to-prompt-injection-attacks/

https://thehackernews.com/2025/08/cursor-ai-code-editor-fixed-flaw.html

https://cyberscoop.com/cursor-ai-prompt-injection-attack-remote-code-privileges-aimlabs/

https://www.aim.security/lp/aim-labs-curxecute-blogpost

https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

Details

Source: Mitre, NVD

Published: 2025-08-05

Updated: 2025-08-25

Named Vulnerability: CurXecute

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00047

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored

Detections

Analytics