CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run code

What it is

CVE record: Cursor allowed writing in-workspace files with no approval below 1.3.9; editing a dotfile needed approval but creating one did not. An attacker could chain indirect prompt injection to write .cursor/mcp.json and trigger RCE. Fixed in 1.3.9.

A sibling advisory (GHSA-vqv7-vq92-x87f) covers the same trick via .vscode/settings.json.

How to check

1. Cursor → About: confirm version 1.3.9 or later.

How to fix

1. Update Cursor. Review any unexpected .cursor/mcp.json or .vscode/settings.json in your repos.

# Look for MCP / editor config files you didn't create
git log --diff-filter=A --name-only -- .cursor/mcp.json .vscode/settings.json

Sources

• CVE Record: CVE-2025-54135 ↗
• Cursor advisory GHSA-4cxx-hrm3-49rm ↗
• Cursor advisory GHSA-vqv7-vq92-x87f ↗