CVE-2025-54136

CVE-2025-54136 is a command-injection flaw (CWE-78) in the Cursor AI code editor, versions 1.2.4 and below, in which changes to a previously trusted Model Context Protocol (MCP) configuration are not re-validated, letting a trusted command be silently swapped for an attacker-controlled one. The issue is triggered when an attacker with write permissions on the user's active branches of a source repository containing already-approved MCP servers — or with arbitrary local file-write on the victim's machine — modifies the trusted MCP configuration file; after the user accepts an innocuous MCP entry, the attacker can replace it with a malicious command without any warning or re-prompt. Successful exploitation yields remote and persistent arbitrary code execution on the developer's machine because the established MCP trust bypasses the prompts that would normally expose the change. Only Cursor 1.2.4 or earlier is affected; practical exposure additionally requires the user to have previously approved MCP servers whose configuration is attacker-writable. No public proof-of-concept or confirmed in-the-wild exploitation is known, though EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile) and CISA has not added it to the KEV catalog.

What to do: Upgrade Cursor to version 1.3 or later. Until then, closely review and version-control MCP configuration files in shared repositories (require pull-request review for changes to approved MCP entries) and audit currently approved MCP server commands for unexpected edits, since swaps to already-trusted entries occur with no warning or re-prompt. Treat the fix as urgent given the high EPSS probability of near-term exploitation.