Security Digest · Vulnerability record
CVE-2025-54135: Cursor Agent is vulnerable to prompt injection via MCP Special Files
Cursor is a code editor built for programming with AI.
CVSS 8.6 High EPSS 1.8% · p78 Most can relax
Should you act?
Normal patch cycle
No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.8%, percentile 78: FIRST’s model estimates a 1.8% chance of exploitation activity in the next 30 days, higher than 78% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Editorial verdict: Most can relax. Cursor CurXecute: Prompt Injection to RCE via mcp.json — Cursor auto-updates and both bugs were fixed by mid-2025; the lasting takeaway is to treat any agent that can write its own tool config as a code-execution path.
What it is
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Weakness type: CWE-78, CWE-829.
Product: cursor cursor · Assigned by: GitHub_M · Published: 2025-08-05
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| cursor | cursor | < 1.3.9 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: high (needs special conditions)
- Privileges required: low (any account)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 1.81% probability of exploitation activity in the next 30 days; percentile 78.
Timeline
- — erroneo.us brief: Cursor CurXecute: Prompt Injection to RCE via mcp.json
- — CVE record last updated
- — CVE record published by GitHub_M
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- CVE.org record CVE-2025-54135 cve.org
- NVD entry CVE-2025-54135 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com