Cursor agent: writing MCP config files without approval enabled code execution (CVE-2025-54135), per Cursor advisory

Summary

Cursor's advisory says "Cursor allows writing in-workspace files with no user approval" and that, if chained with a prompt injection, this "could allow the writing of sensitive MCP files on the host by the agent." Affected versions are ≤1.2.1, and it was patched in 1.3.9.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

• MEASURE 2.7 Security and resilience are evaluated and documented
• MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

• CM-5 Access Restrictions for Change
• SI-10 Information Input Validation
• AC-6 Least Privilege

Human-approval (JCR) checkpoint

yes: file writes that lead to command execution

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• Cyber CYB-006 Langflow before 1.3.0 allowed unauthenticated remote code execution, per GitHub advisory

  same technique derived from CYB-006

  Technique-level similarity only: both describe code execution in AI-agent building or coding tooling, through an unauthenticated Langflow endpoint here and agent-written MCP config files in Cursor in AIA-013.

  Source: github.com https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

• Cyber CYB-007 MCP Inspector below 0.14.1 allowed unauthenticated remote code execution, per GitHub advisory

  same technique derived from CYB-007

  Both involve MCP tooling leading to command execution: unauthenticated requests could launch MCP commands through the Inspector proxy, and Cursor's advisory describes agent-written MCP config files that enabled code execution.

  Source: github.com https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

• Cyber CYB-008 mcp-remote exposed to OS command injection from untrusted MCP servers, per GitHub advisory

  same technique derived from CYB-008

  Both involve MCP tooling leading to command execution: a crafted authorization_endpoint from an untrusted MCP server could inject OS commands into mcp-remote, and Cursor's advisory describes agent-written MCP config files that enabled code execution.

  Source: github.com https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

Sources

• github.com primary link checked 2026-10-31, HTTP 200
  Vendor advisory published Aug 2, 2025. Press name "CurXecute" (Aim Security) is not in this source and is not used.
  https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

Corrections

No corrections recorded.

To report an error in this entry, see corrections.