Incident Overview
On August 1, 2025, researchers from Aim Security disclosed a critical vulnerability in Cursor IDE, identified as CVE-2025-54135, dubbed CurXecute. The flaw allowed an attacker to execute arbitrary code on a developer’s machine by exploiting an MCP (Multi-Channel Protocol) server. The attack chain began with a malicious Slack message processed through an MCP server, which instructed Cursor’s agent to modify the project’s MCP configuration. The IDE then executed these changes without user confirmation, resulting in remote code execution (RCE).
The vulnerability affected Cursor IDE versions prior to 1.3.0, where the issue was patched by introducing a mandatory approval step before newly added MCP servers could execute. A related flaw, CVE-2025-54136 (MCPoison), was also addressed in the same update.
This incident highlights the risks of unvalidated configuration modifications in development environments, particularly when external channels like Slack or MCP servers interact directly with local IDE processes. The lack of explicit user confirmation for critical actions exacerbated the exploitability of the flaw.
Cursor, developed by Anysphere, is a code generation and coding assistant designed to enhance developer productivity. The vulnerability underscores the importance of secure configuration management in IDEs, especially those integrating with external services or protocols.
The attack leveraged the IDE’s reliance on MCP servers for real-time updates and communication. By manipulating the MCP configuration remotely, an attacker could bypass intended security controls and execute arbitrary commands on the host system. This method of prompt injection through an MCP server was novel and demonstrated how seemingly benign communication channels could be weaponized for RCE.
The harm caused by this vulnerability included unauthorized agent actions, prompt manipulation, and policy bypass, all of which could lead to full system compromise if exploited successfully. Developers using Cursor IDE were at risk if they had MCP servers configured without proper validation or approval mechanisms in place.
Possible Root Cause
The root cause of CVE-2025-54135 stemmed from Cursor IDE’s design flaw in handling MCP server configurations. Specifically, the IDE allowed MCP servers to modify project configurations without requiring explicit user approval. When a Slack message or another external input was processed through an MCP server, the agent would rewrite the project’s MCP configuration file directly. This file was then executed by the IDE without further verification, enabling an attacker to inject malicious commands.
The vulnerability exploited the trust relationship between the IDE and MCP servers. Since MCP servers were treated as authoritative sources for configuration updates, the IDE did not challenge or validate the changes before applying them. This lack of validation created an opportunity for attackers to manipulate the configuration file and execute arbitrary code.
Had the IDE enforced stricter access controls or required user confirmation for configuration changes, the attack surface would have been significantly reduced. The patch introduced in version 1.3.0 addressed this by mandating approval for newly added MCP servers, thereby closing the immediate execution pathway.
The simultaneous patching of both vulnerabilities suggests a broader issue in how Cursor handled external configuration inputs, reinforcing the need for robust validation and approval workflows in development environments.
Takeaways
The lack of user confirmation for MCP server modifications allowed attackers to bypass security controls entirely, demonstrating the dangers of over-trusting automated processes.
- Always review and approve configuration changes, especially those initiated by external channels like MCP servers or Slack integrations.
- In this case, upgrading to Cursor version 1.3.0 or later would have prevented exploitation of CVE-2025-54135 and CVE-2025-54136.
- Restrict the permissions of MCP servers and other external services to only those actions necessary for their intended purpose.
- Educate development teams about the risks of prompt injection and configuration manipulation attacks. Training should cover how to recognize suspicious activity, such as unexpected configuration changes or unauthorized code execution attempts.
Future versions of Cursor and similar tools should incorporate mandatory user approval for high-risk actions, such as configuration modifications or code execution triggered by external inputs.
The CurXecute vulnerability also underscores the importance of secure defaults in software design. By defaulting to a more restrictive security posture—such as requiring approval for MCP server actions—the risk of exploitation would have been minimized from the outset.