CVE-2025-54135: Anysphere Cursor RCE Vulnerability

CVE-2025-54135 Overview

CVE-2025-54135 is a critical command injection vulnerability affecting Cursor, an AI-powered code editor developed by Anysphere. The vulnerability allows attackers to achieve remote code execution (RCE) by exploiting a flaw in how Cursor handles file creation within workspaces. Specifically, versions below 1.3.9 permit writing in-workspace files without user approval, and while editing existing dotfiles requires approval, creating new dotfiles does not.

This inconsistency in permission handling creates a dangerous attack surface. If sensitive MCP (Model Context Protocol) configuration files such as .cursor/mcp.json do not already exist in the workspace, an attacker can chain an indirect prompt injection attack to hijack the AI context, write malicious content to settings files, and ultimately trigger arbitrary code execution on the victim's machine without any user approval required.

Critical Impact

Attackers can achieve unauthenticated remote code execution by chaining indirect prompt injection with unprotected dotfile creation, allowing complete system compromise without user interaction.

Affected Products

• Anysphere Cursor versions prior to 1.3.9
• All platforms running vulnerable Cursor installations
• Workspaces without pre-existing .cursor/mcp.json configuration files

Discovery Timeline

• August 5, 2025 - CVE-2025-54135 published to NVD
• August 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54135

Vulnerability Analysis

This vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) stems from an inconsistent access control implementation in Cursor's file handling mechanisms. The AI-powered code editor was designed with a permission system intended to protect sensitive configuration files, but a critical gap exists: while modifications to existing dotfiles require explicit user approval, the creation of new dotfiles bypasses this protection entirely.

The attack leverages the Model Context Protocol (MCP) configuration system used by Cursor to manage AI integrations and tool configurations. The .cursor/mcp.json file can define external tool integrations that execute commands on the host system. When this file doesn't exist, an attacker who can influence the AI context (via indirect prompt injection through malicious content in files, web pages, or other data sources the AI processes) can instruct the AI to create a malicious MCP configuration.

Once the malicious .cursor/mcp.json is created, the attacker-controlled configuration can define tool endpoints or commands that execute arbitrary code when the AI invokes them, achieving full remote code execution without any user approval dialogs.

Root Cause

The root cause lies in the asymmetric permission model applied to dotfile operations. The security logic correctly identifies dotfile modification as a sensitive operation requiring user consent but fails to apply the same protection to dotfile creation. This oversight allows the creation of new configuration files that can fundamentally alter the behavior of the application, including enabling code execution paths that were previously unavailable.

The vulnerability is compounded by the inherent risks of AI-powered applications that process external content. Indirect prompt injection attacks exploit the AI's inability to distinguish between legitimate instructions and malicious content embedded in data it processes, making this a particularly dangerous attack vector for AI-integrated development tools.

Attack Vector

The attack exploits Cursor's network-accessible AI processing capabilities. An attacker can embed malicious prompt injection payloads in content that a developer might open or reference in Cursor—such as source code repositories, documentation, web pages, or any other content the AI assistant might analyze. When Cursor's AI processes this content, the injected instructions can manipulate the AI into:

1. Checking for the absence of the .cursor/mcp.json file
2. Creating a new MCP configuration file with attacker-controlled content
3. Defining malicious tool integrations or command execution endpoints
4. Triggering code execution through the newly created configuration

Because creating new dotfiles requires no user approval, the entire attack chain can execute silently without alerting the victim. The network attack vector combined with no required privileges or user interaction makes this vulnerability particularly severe.

Detection Methods for CVE-2025-54135

Indicators of Compromise

• Unexpected creation of .cursor/mcp.json files in workspace directories
• MCP configuration files containing unfamiliar or suspicious tool definitions
• Unusual outbound network connections originating from Cursor or child processes
• Unauthorized process spawning from the Cursor application
• Workspace configuration files with timestamps that don't align with user activity

Detection Strategies

• Monitor file system events for creation of dotfiles in .cursor/ directories, particularly mcp.json
• Implement endpoint detection rules to alert on Cursor spawning unexpected child processes
• Review MCP configuration files for suspicious external endpoints or command definitions
• Deploy behavioral analysis to detect AI-assisted file operations that bypass normal user workflows
• Audit workspace directories for configuration files created without corresponding user actions

Monitoring Recommendations

• Enable file integrity monitoring (FIM) on .cursor/ configuration directories across all development workstations
• Configure SIEM rules to correlate Cursor process activity with network connections and child process creation
• Implement logging for AI assistant actions, particularly file creation and modification events
• Review developer workstation logs for signs of prompt injection attempts in processed content

How to Mitigate CVE-2025-54135

Immediate Actions Required

• Upgrade Cursor to version 1.3.9 or later immediately across all affected systems
• Audit existing workspaces for unauthorized .cursor/mcp.json files and review their contents
• Remove or quarantine any suspicious MCP configuration files pending investigation
• Review recent AI assistant activity logs for signs of unauthorized file operations
• Consider temporarily disabling AI features if immediate patching is not possible

Patch Information

Anysphere has addressed this vulnerability in Cursor version 1.3.9. The fix implements consistent permission requirements for both creation and modification of sensitive dotfiles, ensuring that creating new configuration files like .cursor/mcp.json now requires explicit user approval, matching the protection already in place for modifications.

Organizations should prioritize upgrading to version 1.3.9 or later. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Pre-create empty or minimal .cursor/mcp.json files in sensitive workspaces to ensure modification protections apply
• Implement operating system-level file access controls restricting write access to .cursor/ directories
• Use application allowlisting to prevent unauthorized processes from being spawned by Cursor
• Configure workspace-level read-only policies where AI code editing features are not required
• Educate developers about prompt injection risks when working with AI-assisted coding tools

# Pre-create protected mcp.json to prevent unauthorized creation
mkdir -p .cursor
touch .cursor/mcp.json
echo '{}' > .cursor/mcp.json
chmod 444 .cursor/mcp.json