AdvisoriesBuildersChecklistSubmitSponsorGet the email
← All advisories
Advisory VV-010high2025-08

CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swapped

In Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt.

01.

What it is

NVD: attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file in a shared GitHub repo. Fixed in 1.3: Cursor now asks for approval every time an mcpServer entry changes.

02.

How to check

  1. Confirm Cursor 1.3+; review git history of .cursor/mcp.json in shared repos.
03.

How to fix

  1. Update Cursor and require code review for changes to MCP config files (e.g. CODEOWNERS).
# .github/CODEOWNERS — force review of AI agent config
.cursor/      @your-security-reviewer
.cursorrules  @your-security-reviewer
04.

Sources

The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.