CVE-2025-54136
Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
Description
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3.
INFO
Published Date :
Aug. 2, 2025, 12:15 a.m.
Last Modified :
June 17, 2026, 9:39 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Cursor to version 1.3 or later.
- Review and validate all MCP configuration files.
- Restrict write permissions on active branches.
- Implement code review for MCP files.
Public PoC/Exploit Available at Github
CVE-2025-54136 has a 58 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-54136.
| URL | Resource |
|---|---|
| https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395 | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-54136 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-54136
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Security guardrails for vibe coding. Blocks insecure AI-generated code at the moment it's written - hardcoded secrets, SQL injection, hallucinated packages, and agent supply-chain attacks.
ai-security appsec claude-code devsecops llm-security owasp slopsquatting supply-chain-security vibe-coding ai-code-review
JavaScript
capsule — LLM-free content-addressed lockfile + supply-chain mutability auditor for agent capabilities (Agent Skills + MCP server configs). Pins each capability by content hash, flags unpinned npx/pip/curl|sh/mutable git+container refs, fails CI on drift (static rug-pull detection) + hazard gate. Dev Experiment 010.
Makefile Python
Security skills for vibe coders - Don't ship what Cursor forgot to lock down
Shell
A lightweight mcp to prevent poisoning CVE (CVE-2025-54136), researchers hijacking Claude Code/Copilot/Gemini via prompt injection, and hundreds of MCP servers exposed with zero auth, this mcp protects the individual developer's laptop, where most MCP servers actually run.
ai-agents mcp mcp-server prompt-injection security llm-security-proxy model-context-protocol-security
JavaScript TypeScript
None
Makefile Shell HTML Python
Reusable GitHub Actions security workflows for personal repos
Shell Dockerfile
MCP 安全扫描器，10/10 OWASP MCP Top 10 全覆盖，零 API 依赖，pip install 即用
Python
Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).
ai-security detection-engineering mcp model-context-protocol owasp purple-team security sigma soc threat-detection
Python
Prompt-injection / hidden-content scanner for LLM inputs. Monorepo (shared core + Claude Desktop MCP server + browser-only Web). All processing runs locally.
JavaScript HTML
HydraSentry - HydraDB-native context-integrity harness + MCP security cockpit for memory-powered AI agents (HydraDB Build Blitz).
Python CSS TypeScript JavaScript HTML TeX
AETHER_01 — Full-spectrum Windows 10/11 MCP Server on Rust. 10 tools, 99% system management coverage including GUI automation. Maximum speed, maximum security.
mcp mcp-server rust system-administration windows windows-automation
Rust PowerShell JavaScript
A semantic scanner for malicious MCP servers and agent skills — prompt-injection, tool-poisoning, rug-pulls, excessive agency.
agent-security ai-security mcp owasp prompt-injection python supply-chain
Python
Safety-review a third-party agent skill before it can act. Injection-proof deterministic scanner + sandboxed semantic pass. /airlock for Claude Code.
Python
Two structural MCP-layer vulnerabilities in Claude Code allowing usage of CC without limitations (tool-result injection, tool-description poisoning).
Shell JavaScript C Makefile
None
JavaScript TypeScript CSS Solidity Dockerfile
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-54136 vulnerability anywhere in the article.
-
The Hacker News
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
Two flaws in Cursor, an AI code editor, could let a single, ordinary-looking prompt break out of the editor's safety sandbox and run any command on a developer's computer. There is no click to fall fo ... Read more
-
The Hacker News
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and ... Read more
-
Proofpoint
CursorJack: weaponizing Deeplinks to exploit Cursor IDE
Author’s Note: This post reflects Proofpoint Threat Research observations in a controlled test environment as of January 19, 2026. Proofpoint has no commercial, customer, partner, or vendor relationsh ... Read more
-
Daily CyberSecurity
The Poisoned Pickle: Critical Unpatched RCE Flaws Expose SGLang AI Infrastructure
Security researchers have issued a warning to the AI development community following the discovery of critical vulnerabilities in SGLang, a popular open-source serving framework for Large Language Mod ... Read more
-
Daily CyberSecurity
CVE-2026-2256: Unpatched Flaw in MS-Agent Lets Hackers Hijack AI Assistants
We are officially entering the era of the “autonomous agent”—smart AI programs that don’t just chat with you, but actually do things on your computer, like organizing files, searching the web, or runn ... Read more
-
Daily CyberSecurity
Critical 9.8 Flaw in Langflow’s AI CSV Agent Opens a Direct Path to Root Shell
Artificial intelligence is making it easier than ever to build complex applications, but a newly discovered vulnerability shows that these same tools can inadvertently leave the front door wide open f ... Read more
-
TheCyberThrone
CVE-2025-53786 affects Microsoft Exchange
August 7, 2025CVE-2025-53786 is a high-severity elevation of privilege vulnerability found in Microsoft Exchange Server hybrid deployments. The flaw allows an attacker with administrative access to an ... Read more
-
TheCyberThrone
Trend Micro Apex One Critical Vulnerabilities
August 7, 2025OverviewIn early August 2025, Trend Micro issued an urgent security bulletin disclosing two actively exploited critical vulnerabilities in its Apex One and Apex One as a Service (on-prem ... Read more
-
TheCyberThrone
CVE-2025-54136 affects Vibe Coding tool Cursor
August 6, 2025A critical code execution vulnerability, tagged as CVE-2025-54136 (also dubbed “MCPoison”), was found in the Cursor AI-powered code editor. This vulnerability is particularly dangerous f ... Read more
-
CybersecurityNews
New MCPoison Attack Leverages Cursor IDE MCP Validation to Execute Arbitrary System Commands
A critical vulnerability in Cursor IDE, the rapidly growing AI-powered development environment, enables persistent remote code execution through manipulation of the Model Context Protocol (MCP) system ... Read more
-
The Hacker News
Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval
Aug 05, 2025Ravie LakshmananAI Security / MCP Protocol Cybersecurity researchers have disclosed a high-severity security flaw in the artificial intelligence (AI)-powered code editor Cursor that coul ... Read more
-
Daily CyberSecurity
The Telecom Threat: Liminal Panda’s Covert Campaign Targets Southwest Asian Critical Infrastructure
High-level chain of events in the attack investigated by Unit 42 In a revealing report by Palo Alto Networks’ Unit 42, a high-level cyberespionage campaign targeting critical telecommunications infras ... Read more
-
Daily CyberSecurity
Prompt Injection to Code Execution: Cursor Code Editor Hit by Critical MCP Vulnerabilities (CVE-2025-54135 & CVE-2025-54136)
Cursor, an AI-powered code editor that promises to “understand your codebase and help you code faster,” has issued patches for two severe vulnerabilities that could enable remote code execution (RCE) ... Read more
-
Daily CyberSecurity
Storm-2603: Chinese APT Deploys Warlock & LockBit with AK47C2 Framework
Antivirus Terminator supported arguments when run without parameters | Image: Check Point Check Point Research (CPR) has detailed a previously undocumented Chinese-affiliated threat actor—Storm-2603—l ... Read more
The following table lists the changes that have been made to the
CVE-2025-54136 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'cursor', 'product': 'cursor', 'versions': [{'status': 'affected', 'version': '< 1.3'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-54136', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-08-04T17:16:34.453679Z'} -
Initial Analysis by [email protected]
Aug. 25, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:* versions up to (excluding) 1.3 Added Reference Type GitHub, Inc.: https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395 Types: Vendor Advisory -
New CVE Received by [email protected]
Aug. 02, 2025
Action Type Old Value New Value Added Description Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395