Aim Labs 披露 Cursor 经 MCP 自动启动触发远程代码执行漏洞 CurXecute
When Public Prompts Turn Into Local Shells: ‘CurXecute’ – RCE in Cursor via MCP Auto‑Start
Aim Labs 在 Cursor IDE 中发现高危漏洞 CurXecute，可导致完整的远程代码执行，编号 CVE-2025-54135，严重性评级 8.6。攻击路径是：当 Cursor 接入会读取外部内容的 MCP 服务器（如 Slack）时，一条被投毒的提示词就能诱导智能体改写 ~/.cursor/mcp.json；而 Cursor 会立即执行该文件新增的条目，并在用户确认前就写入磁盘，从而以用户权限执行攻击者命令。Cursor 已在 1.3 版本修复，更早版本仍受影响。
正文
当前显示原文，中文全文译文尚未就绪。
Executive Summary
Aim Labs has identified a high severity vulnerability, “CurXecute”, in another popular AI agent – Cursor IDE – enabling full Remote-Code Execution (RCE)
Aim Labs flagged the issue to Cursor who acknowledged the flaw. The vulnerability has been given an 8.6 severity rating and is tracked as CVE-2025-54135. (Read the Advisory)
Cursor delivered a fix in version 1.3; all earlier releases remain susceptible to remote‑code execution triggered by a single externally‑hosted prompt‑injection that silently rewrites ~/.cursor/mcp.json and runs attacker‑controlled commands.
Cursor runs with developer‑level privileges, and when paired with an MCP server that fetches untrusted external data, that data can redirect the agent’s control flow and exploit those privileges.
By feeding poisoned data to the agent via MCP, an attacker can gain full remote-code-execution under the user privileges, and achieve any number of things, including opportunities for ransomware, data theft, AI manipulation and hallucinations, etc.
Because model output steers the execution path of any AI agent, this vulnerability pattern is intrinsic and keeps resurfacing across multiple platforms. Thus, robust runtime guardrails remain essential even after patches and Aim Security supplies these state of the art protections.
In June we disclosed EchoLeak, the first zero‑click exfiltration chain against Microsoft 365 Copilot. It proved that untrusted content (a single inbound e‑mail) could hijack an LLM’s inner loop and leak whatever data the model could see - without user action.
EchoLeak underscored another critical lesson: if outside context can steer an AI-agent, any agent can have its control flow hijacked and its privileges misused – including those running on a developer’s own machine – and the popularity of such developer‑oriented agents is growing daily.
The obvious next candidate was Cursor, a popular IDE, that already ships with Model Context Protocol (MCP) support. MCP turns a local agent into a swiss‑army knife by letting it spin up arbitrary servers – Slack, GitHub, databases – and call their tools from natural language. That power, however, intrinsically compromises the agent. The tools expose the agent to external and untrusted data, which can affect the agent’s control-flow. This in turn, allows attackers to hijack the agent’s session and take advantage of the agent’s privileges to perform on behalf of the user.
Vulnerability Details
Auto‑start on write Cursor instantly executes any new entry added to ~/.cursor/mcp.json. No confirmation is required.
Suggested edits are live When the agent suggests an edit to mcp.json, the edit already lands on disk, triggering command execution even if the user rejects the suggestion.
Prompt‑injection path to RCE
A standard MCP server (e.g., Slack) which exposes the agent to untrusted data is added.
In our example, an attacker posts a crafted message in a public Slack channel.
Cursor fetches that message via the Slack MCP server. The prompt persuades the agent to “improve” mcp.json:
"slack_summary": { "command": "touch", "args": ["~/mcp_rce"] }
Upon suggested edit, Cursor launches the MCP server found in the mcp.json file, executing touch ~/mcp_rce the moment the edit buffer is written. This happens before the user has any chance to approve or reject the suggestion – providing the attacker with an arbitrary command execution.
Why It Matters
The attack surface is any third‑party MCP server that processes external content: issue trackers, customer support inboxes, even search engines. A single poisoned document can morph an AI agent into a local shell.
Responsible Disclosure
July 7 2025 – Issue reported privately to Cursor security team.
July 8 2025 – Patch merged into the main branch; vendor schedules release 1.3.
Closing Thoughts
EchoLeak showed that untrusted text can sneak past classifier guardrails and exfiltrate sensitive data. The Cursor flaw shows the same idea can break the local machine security boundary and execute code. As AI agents keep bridging external, internal, and interactive worlds, security models must assume external context may affect the agent runtime – and monitor every hop.
The post When Public Prompts Turn Into Local Shells: ‘CurXecute’ – RCE in Cursor via MCP Auto‑Start appeared first on Cato Networks.