Advisory VV-009high2025-08
CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run code
Before 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution.
What it is
CVE record: Cursor allowed writing in-workspace files with no approval below 1.3.9; editing a dotfile needed approval but creating one did not. An attacker could chain indirect prompt injection to write .cursor/mcp.json and trigger RCE. Fixed in 1.3.9.
A sibling advisory (GHSA-vqv7-vq92-x87f) covers the same trick via .vscode/settings.json.
How to check
- Cursor → About: confirm version 1.3.9 or later.
How to fix
- Update Cursor. Review any unexpected .cursor/mcp.json or .vscode/settings.json in your repos.
# Look for MCP / editor config files you didn't create
git log --diff-filter=A --name-only -- .cursor/mcp.json .vscode/settings.json