Cursor CurXecute: indirect prompt injection writes .cursor/mcp.json -> RCE
Date: 2025-08
Affected: Cursor < 1.3.9
Attack vector: prompt-injection
Category: real-world
Severity: High
CVE: CVE-2025-54135
CWE: CWE-78
CWE-829
CVSS: 8.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Cursor IDE CurXecute (CVE-2025-54135). Attackers send crafted Slack messages processed by an attached Slack MCP server; Cursor reads them, writes/modifies the global mcp.json config without user approval, and immediately executes the malicious command. CVSS 8.6. Fixed in 1.3.9.


Mitigations:

Architectural layers (MAESTRO):