Critical Vulnerability in AI-Powered Cursor IDE Allows Remote Code Execution

Critical Vulnerability Discovered in Cursor IDE

Cybersecurity researchers have uncovered a series of high-severity vulnerabilities in Cursor, a popular AI-powered code editor. The most critical flaw, dubbed "MCPoison" (CVE-2025-54136), could allow attackers to achieve remote code execution by exploiting the way Cursor handles Model Context Protocol (MCP) server configurations 1

1

Understanding MCPoison

Source: The Register

The MCPoison vulnerability stems from Cursor's one-time approval process for MCP configurations. Once an initial configuration is approved, Cursor trusts all future modifications without requiring new validation. This trust model can be exploited by attackers to silently swap a benign MCP command with a malicious payload, potentially gaining persistent access to a victim's machine 2

2

CurXecute: Another Critical Flaw

Source: Hacker News

Researchers also identified another vulnerability called "CurXecute" (CVE-2025-54135), which allows attackers to execute remote code with developer privileges by feeding the AI agent a malicious prompt. This flaw could potentially lead to ransomware attacks, data theft, and AI manipulation 3

3

Exploitation Techniques

Attackers could exploit these vulnerabilities through various methods:

1. Modifying shared GitHub repositories with malicious MCP configurations
2. Injecting malicious prompts via external data sources, such as Slack channels
3. Embedding hidden instructions in GitHub README files
4. Leveraging tool combination attacks to exfiltrate sensitive data

Broader Implications for AI-Assisted Development

Source: BleepingComputer

These vulnerabilities highlight the potential risks associated with AI-powered development tools. As AI agents bridge external, internal, and interactive worlds, security models must account for how external context can affect agent runtime 4

4

Related Stories

Critical Security Flaw in Cursor AI Code Editor Exposes Users to Malware Risk

IDEsaster research reveals 30+ critical flaws in AI coding tools enabling data theft and RCE

Anthropic's Model Context Protocol has critical flaw exposing 200,000 servers to remote takeover

Anthropic patches critical Git MCP server flaws that enabled remote code execution via AI tools

Mitigation and Patches

Cursor has addressed these vulnerabilities in version 1.3, released on July 29, 2025. Key improvements include:

1. Requiring user approval for every MCP configuration file modification
2. Deprecating the denylist feature in favor of an allowlist approach
3. Implementing additional security measures to prevent unauthorized command execution

Industry Response and Future Concerns

The discovery of these vulnerabilities has raised concerns about the security of AI-assisted coding tools. Check Point Research warns that this is just the first in a series of flaws they've uncovered in developer-focused AI platforms, suggesting that more security issues may come to light in the near future 1

1

As AI continues to shape modern software workflows, cybersecurity researchers emphasize the need for robust security measures and thorough vetting of AI-powered development tools to mitigate potential risks and protect sensitive data and intellectual property.