Cursor IDE Remote Code Execution and Model Context Protocol Vulnerabilities
Security researchers discovered remote code execution vulnerabilities in the Cursor AI code editor. The vulnerabilities, disclosed separately by Check Point Research and Aim Security, exploit automatic execution of Model Context Protocol (MCP) configurations and prompt injection to enable arbitrary code execution. Cursor released patches requiring user authorization for configuration changes.
What happened
Check Point Research identified a remote code execution vulnerability called 'MCPoison' in Cursor, an AI-integrated IDE that uses Anthropic's Model Context Protocol (MCP) standard. The vulnerability arises because Cursor automatically executes MCP configurations after detecting changes to the ~/.cursor/mcp.json file without requiring user confirmation.
Aim Security separately disclosed a vulnerability called CurXecute (CVE-2025-54135) affecting Cursor, with a CVSS score of 8.6. The vulnerability exploits the automatic execution of MCP configurations and allows attackers to inject malicious content through untrusted external sources like Slack, GitHub, or other MCP-supported platforms. Cursor released version 1.3 and later 1.3.9 on July 8 to address the issues, requiring user authorization before modifying MCP configurations with each project change.
Reported impact
Attackers exploiting the vulnerability could achieve arbitrary remote code execution through prompt injection attacks. By injecting malicious data into external platforms connected via MCP, attackers can hijack the AI agent's session and execute commands with the privileges of the user running Cursor.
Index analysis
The vulnerability stems from three technical factors: MCP's automatic execution mechanism, real-time suggestion editing of configuration files stored on disk, and prompt injection pathways that trigger remote code execution. Configuration changes are written to disk and executed even if users reject them, enabling persistent attack chains.
The MCP standard, designed to extend AI systems with external data sources and tools, creates additional attack surface by exposing the agent to untrusted external data. The protocol lacks sufficient verification mechanisms before executing configuration changes initiated by external or untrusted sources.
Governance controls
Cursor implemented fixes requiring user authorization for MCP configuration changes. However, the vulnerabilities highlight gaps in the security model of integrating AI agents with external protocols and data sources without adequate safeguards against malicious input or hijacked sessions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.