VibeCurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server
Incident dateNot stated
DisclosedAug 2, 2025 (Cursor advisory). NVD published Aug 5, 2025.
Added hereOct 13, 11:49 PM ET
Last verifiedOct 14, 2026
Summary
Aim Security reported that a malicious message coming in through an MCP-connected service could steer Cursor's agent into creating a .cursor/mcp.json file. Cursor would then start the new MCP server and run attacker-chosen commands without asking. Cursor fixed it in version 1.3.9.
Severity
HIGH Remote code execution on a developer's machine from untrusted content. Fixed in 1.3.9.
Timeline
Aim Security reports the issue to Cursor.
Cursor publishes advisory GHSA-4cxx-hrm3-49rm: versions up to 1.2.1 affected, fixed in 1.3.9.
NVD publishes CVE-2025-54135.
How it happened
Creating a new MCP config file did not require approval, and new servers in it started automatically. Text from an outside source (for example a chat message read through an MCP tool) could tell the agent to write that file.
How to check your app
- Make sure Cursor is on 1.3.9 or later.
- Review .cursor/mcp.json in your repos and remove servers you did not add.
- Keep auto-run off for agents that read untrusted content.
Sources
Corrections and updates
Added the advisory and NVD publication dates and the affected versions from Cursor's advisory. The log date changed from '2025' to Aug 2, 2025.
If you would rather have someone look at your app for this kind of problem, LockedVibe runs security scans for vibe-coded apps. Their free Lockdown Pack is a good first step too.