Understand this story
Aim Labs disclosed the discovery of a high-severity remote code execution vulnerability, CurXecute, in Cursor IDE, tracked as CVE-2025-54135, with a severity rating of 8.6. The attack path of this vulnerability is: when Cursor connects to an MCP server that reads external content (such as Slack), a single poisoned prompt can induce the agent to rewrite ~/.cursor/mcp.json; Cursor immediately executes newly added entries in that file and writes them to disk before user confirmation, thereby executing attacker commands with user privileges. Cursor has fixed this vulnerability in version 1.3; earlier versions remain affected.
AI-generated from public reports
Latest development · Report
Aim Labs discloses Cursor MCP auto-start remote code execution vulnerability CurXecuteDevelopments
1 confirmed developments
Aim Labs discloses high-severity RCE vulnerability CurXecute in Cursor IDE
Source:Cato AI Labs
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Jan 8
Cato AI LabsFirst-partySelected
Aim Labs discloses Cursor MCP auto-start remote code execution vulnerability CurXecute
Aim Labs discovered a high-severity vulnerability, CurXecute, in the Cursor IDE that can lead to full remote code execution, tracked as CVE-2025-54135, with a severity rating of 8.6. The attack path is: when Cursor connects to an MCP server that reads external content (such as Slack), a single poisoned prompt can induce the agent to rewrite ~/.cursor/mcp.json; Cursor then immediately executes newly added entries in that file and writes them to disk before the user confirms, thereby executing attacker commands with the user's privileges. Cursor has fixed this in version 1.3; earlier versions remain affected.