CVE-2025-54136

Published Aug 2, 2025

Last updated a month ago

Cursor AI

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54136 affects Cursor, an AI-powered code editor, specifically versions 1.2.4 and below. The vulnerability allows attackers to achieve remote code execution (RCE) by modifying a trusted Multi-Context Prompting (MCP) configuration file. This can be done either within a shared GitHub repository or locally on the target's machine. The vulnerability stems from a trust abuse issue in MCP server configuration. Once a user approves an MCP server, an attacker with write access can replace it with a malicious one without requiring re-approval. This enables the attacker to inject malicious commands, potentially leading to persistent backdoors, especially in collaborative coding environments. The issue has been addressed in Cursor version 1.3, which now prompts for re-approval whenever an mcpServer entry is modified.

Description: Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3.
Source: security-advisories@github.com
NVD status: Analyzed
Products: cursor

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6CC3BD06-C788-4AE8-80B9-8CF608AB5F5F",
            "versionEndExcluding": "1.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.