Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

CVE-2025-54136 is a command-injection flaw (CWE-78) in the Cursor AI code editor, versions 1.2.4 and below, in which changes to a previously trusted Model Context Protocol (MCP) configuration are not re-validated, letting a trusted command be silently swapped for an attacker-controlled one. The issue is triggered when an attacker with write permissions on the user's active branches of a source repository containing already-approved MCP servers — or with arbitrary local file-write on the victim's machine — modifies the trusted MCP configuration file; after the user accepts an innocuous MCP entry, the attacker can replace it with a malicious command without any warning or re-prompt. Successful exploitation yields remote and persistent arbitrary code execution on the developer's machine because the established MCP trust bypasses the prompts that would normally expose the change. Only Cursor 1.2.4 or earlier is affected; practical exposure additionally requires the user to have previously approved MCP servers whose configuration is attacker-writable. No public proof-of-concept or confirmed in-the-wild exploitation is known, though EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile) and CISA has not added it to the KEV catalog.

Do: Upgrade Cursor to version 1.3 or later. Until then, closely review and version-control MCP configuration files in shared repositories (require pull-request review for changes to approved MCP entries) and audit currently approved MCP server commands for unexpected edits, since swaps to already-trusted entries occur with no warning or re-prompt. Treat the fix as urgent given the high EPSS probability of near-term exploitation.

Anthropic's Claude Code, an agentic coding tool, contained a code injection flaw (CWE-94) caused by a bug in its startup trust dialog implementation, so all versions before 1.0.111 are affected. An attacker who controls the contents of a project directory — for example a malicious or compromised repository — can get Claude Code to execute code contained in that project before the user has accepted the startup trust dialog, bypassing the prompt meant to gate execution. The trigger is simply a user starting Claude Code in an untrusted directory (user interaction is required, per the CVSS 4.0 vector scored 8.7 High), and a successful attack yields arbitrary code execution with the developer's local privileges, potentially exposing source code and credentials accessible to that account. Users on the standard auto-update channel have already received the fix automatically, while manually updated or version-pinned installations remain exposed until upgraded to 1.0.111 or later. No public proof-of-concept or CISA KEV listing is known, but EPSS assigns a 26.4% probability of exploitation within 30 days (98th percentile), and related research on Claude Code code execution and a similar Amazon Q Developer flaw indicates active researcher and attacker interest in this attack surface.

Do: Update Claude Code to version 1.0.111 or later; auto-update users should already be patched but should verify the installed version on each workstation, while manually updated or pinned installs must be upgraded explicitly. Until patched, avoid starting Claude Code in untrusted or freshly cloned project directories, and treat trust-dialog prompts on unpatched versions as not yet protective.

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to Language Servers for AWS version 1.65.0 or higher.

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further user interaction. Successful exploitation may allow attackers to execute commands on behalf of the user, persist malicious MCP configuration changes, and access sensitive information exposed through the application.