CurXecute: Cursor agent turned into remote code execution via MCP config

Aim Labs found that prompt injection reaching Cursor's agent could write a new MCP server entry to the project config, which Cursor executed without confirmation. Tracked as CVE-2025-54135.

Occurred 7 July 2025 · Disclosed 1 August 2025 · Record updated 1 October 2026

Impact

Remote code execution on developer machines from untrusted content such as a Slack message or web page. Fixed in Cursor 1.3.

Our coverage

A puppet master's strings invisibly guide a wooden figure to rewrite its own control panel, then execute commands without hesitation.

Vulnerabilities

Cursor could be turned into remote code execution with one message

Prompt injection let researchers write to the IDE's MCP configuration, which Cursor then ran without asking. Version 1.3 closed the hole.

2 Aug 2025

Sources

aim.securityhttps://www.aim.security/lp/aim-labs-curxecute-blogpost
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2025-54135