CurXecute: prompt injection leads to code execution in the Cursor editor

Timeline

• 2025-07-07. Aim Security reports the issue to Cursor, according to Tenable.
• 2025-08-01. Aim Security discloses it publicly.
• 2025-08-02. Cursor’s security advisory is published.

Trigger or entry point

Untrusted content that reaches the agent through an MCP server. Tenable’s example is a message in Slack.

Failure mechanism

According to the advisory, the agent could create a new configuration file such as .cursor/mcp.json without approval, while editing an existing one required approval. The injected text told the agent to create that file with a command in it. Cursor started the configured MCP server at once, so the command ran before the user accepted or rejected the edit. The advisory classifies the flaw as command injection combined with the inclusion of functionality from an untrusted source.

Impact

The advisory rates the issue 8.5 on the CVSS scale. No exploitation in the wild is reported. The severity is potential. SecurityWeek gives the score as 8.6. Versions up to 1.2.1 are affected. Tenable notes that the flaw was not a zero-day and that the researchers published proof-of-concept details.

Response

Cursor fixed the issue in version 1.3.9, according to the advisory. SecurityWeek describes the fix as part of Cursor version 1.3. Tenable’s FAQ also covers a second Cursor flaw from the same period, tracked as CVE-2025-54136.

Mitigations

Update to the fixed version.