CVE-2025-54133: Anysphere Cursor RCE Vulnerability

CVE-2025-54133 Overview

CVE-2025-54133 is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler that enables attackers to execute arbitrary system commands through social engineering attacks. Cursor is a popular AI-powered code editor, and this vulnerability affects the way it processes cursor://anysphere.cursor-deeplink/mcp/install links.

The core issue lies in the installation dialog's failure to display the full command arguments being passed when users interact with malicious deeplinks. This creates a 2-click attack scenario where users who click a malicious link and subsequently approve the installation dialog will unknowingly execute attacker-controlled commands on their system.

Critical Impact

Attackers can leverage social engineering to trick users into executing arbitrary system commands, potentially leading to full system compromise, data exfiltration, or malware installation.

Affected Products

• Anysphere Cursor versions 1.17 through 1.2

Discovery Timeline

• 2025-08-02 - CVE-2025-54133 published to NVD
• 2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-54133

Vulnerability Analysis

This vulnerability (CWE-78: OS Command Injection) exploits a user interface design flaw in Cursor's MCP deeplink handler. The attack requires user interaction but is facilitated by the deceptive nature of the installation dialog, which obscures critical command-line arguments from the user's view.

When processing cursor://anysphere.cursor-deeplink/mcp/install protocol links, Cursor displays an installation confirmation dialog to the user. However, this dialog only shows the base command without revealing the arguments that will be passed during execution. This information asymmetry allows attackers to craft malicious deeplinks that appear benign but execute harmful commands when approved.

The attack follows a two-step process: first, the victim must click on a malicious deeplink (typically delivered through phishing emails, malicious websites, or compromised documentation). Second, the victim must approve the seemingly innocuous installation dialog without full visibility into what commands will actually run.

Root Cause

The root cause is improper information disclosure in the user interface layer of the MCP deeplink handler. The installation dialog implementation fails to render or display command-line arguments, creating a blind spot where users cannot make informed security decisions. This violates the principle of informed consent and allows command injection through the deeplink protocol.

Attack Vector

The attack requires network-based delivery of malicious deeplinks combined with social engineering. Attackers craft deeplinks containing malicious command arguments and distribute them through various channels. Common attack scenarios include:

The attacker creates a cursor://anysphere.cursor-deeplink/mcp/install link with hidden malicious arguments. This link is then embedded in phishing emails disguised as legitimate Cursor plugin installations, posted on developer forums or documentation sites, or distributed through compromised software repositories. When victims click the link and approve the dialog, the full command including hidden arguments executes with the user's privileges.

Detection Methods for CVE-2025-54133

Indicators of Compromise

• Unexpected process executions spawned from Cursor's process tree
• Unusual outbound network connections initiated after Cursor deeplink interactions
• Command-line arguments in Cursor-related processes that reference unknown or suspicious scripts
• Registry or filesystem modifications following MCP installation attempts

Detection Strategies

• Monitor for cursor:// protocol handler invocations in browser and system logs
• Implement endpoint detection rules for child processes spawned by Cursor with suspicious command-line arguments
• Alert on Cursor processes making unexpected system calls or network connections
• Review application logs for MCP installation events with unusual parameters

Monitoring Recommendations

• Enable process creation auditing to track Cursor's child processes and their command-line arguments
• Implement network monitoring for unusual outbound connections following Cursor activity
• Deploy behavioral analysis to detect anomalous post-installation activities
• Configure endpoint protection to alert on command execution patterns associated with deeplink abuse

How to Mitigate CVE-2025-54133

Immediate Actions Required

• Upgrade Cursor to version 1.3 or later immediately
• Educate users about the risks of clicking deeplinks from untrusted sources
• Block or monitor cursor:// protocol links at the network perimeter where possible
• Review recent MCP installations for any suspicious or unauthorized plugins

Patch Information

Anysphere has addressed this vulnerability in Cursor version 1.3. The fix ensures that the installation dialog now properly displays the complete command including all arguments before execution, allowing users to make informed decisions about whether to proceed. Users should update to version 1.3 or later as soon as possible. For detailed information, refer to the GitHub Security Advisory.

Workarounds

• Disable or block the cursor:// protocol handler at the operating system level until the patch can be applied
• Implement network-level filtering to block or warn on cursor:// protocol links in emails and web traffic
• Use application whitelisting to control which MCP plugins can be installed
• Train users to verify MCP plugin installations through official Cursor channels only

# Example: Disable cursor:// protocol handler on Windows (requires elevated privileges)
# Remove the URL protocol association
reg delete "HKEY_CLASSES_ROOT\cursor" /f

# On macOS, remove the protocol handler from Info.plist or use managed preferences
# Consult your MDM solution for centralized deployment