Cursor could be turned into remote code execution with one message

Aim Labs disclosed a vulnerability in the Cursor AI code editor in August 2025 that allowed an attacker to run code on a developer's machine by sending content the editor's agent would read. The issue was assigned CVE-2025-54135 and named CurXecute.

The chain relied on Cursor's support for the Model Context Protocol. Cursor read MCP server definitions from a configuration file inside the project and, at the time, would start any newly listed server without asking the user. Aim Labs showed that prompt injection, delivered for example through a Slack message fetched by an MCP integration, could instruct the agent to write a new server entry into that file. The entry pointed at an attacker-controlled command, which Cursor then executed with the developer's privileges.

Cursor fixed the problem in version 1.3 by requiring explicit approval before new or modified MCP entries are used. Check Point Research separately reported a related weakness, CVE-2025-54136, in which an already-approved MCP entry could be silently changed after the fact.

Aim Labs rated the issue high severity. The company said the attack was significant because the malicious input never had to touch the developer's own code; it only needed to reach any data source the agent was allowed to read.

The two Cursor advisories were among a cluster of disclosures in mid-2025 targeting MCP configuration handling in developer tools, and prompted several vendors to review how agent-writable config files are treated.