CVE-2025-54136: Anysphere Cursor RCE Vulnerability

CVE-2025-54136 Overview

CVE-2025-54136 is a command injection vulnerability (CWE-78) affecting Cursor, an AI-powered code editor developed by Anysphere. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP (Model Context Protocol) configuration file inside a shared GitHub repository or by editing the file locally on the target's machine.

Once a collaborator accepts a harmless MCP configuration, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt from the application. This vulnerability enables arbitrary code execution when an attacker has write permissions on a user's active branches of a source repository containing previously approved MCP servers, or when the attacker has arbitrary file-write capability locally.

Critical Impact

Attackers with repository write access or local file-write capabilities can achieve persistent arbitrary code execution on victim machines through silent MCP configuration manipulation without user re-authorization.

Affected Products

• Anysphere Cursor versions 1.2.4 and below
• Cursor installations with trusted MCP configurations in shared repositories
• Development environments using collaborative GitHub workflows with MCP servers

Discovery Timeline

• August 2, 2025 - CVE-2025-54136 published to NVD
• August 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54136

Vulnerability Analysis

This vulnerability stems from insufficient validation of MCP configuration files after initial user approval. The Cursor code editor implements a trust model for MCP configurations where users must explicitly approve MCP servers before execution. However, the application fails to re-validate or re-prompt users when the content of an already-approved MCP configuration file is modified.

The attack exploits the gap between the initial trust establishment and subsequent file modifications. When a user approves an MCP configuration, that approval persists even after the configuration's contents are completely replaced with malicious commands. This creates a window where attackers can inject arbitrary commands that execute with the user's privileges without any security warnings.

Root Cause

The root cause is a trust-on-first-use (TOFU) implementation flaw in the MCP configuration handling. The application stores approval decisions based on file identity rather than file content, allowing post-approval modifications to bypass security controls. This represents a Time-of-Check Time-of-Use (TOCTOU) vulnerability where the security check (user approval) occurs at a different time than the actual use (command execution).

Attack Vector

The attack can be executed through two primary vectors:

1. Repository-based Attack: An attacker with write permissions to a shared GitHub repository can modify an MCP configuration file that was previously approved by collaborators. When the victim pulls the updated repository and uses Cursor, the malicious commands execute without prompting for re-approval.

2. Local File Modification: An attacker with local file-write access can directly modify the MCP configuration file on the target system. This could be achieved through another vulnerability, malware, or physical access.

The attack requires low privilege (authenticated repository access or local file write) and no user interaction beyond the initial, legitimate MCP approval. The network-based attack vector enables remote exploitation through collaborative development workflows.

Detection Methods for CVE-2025-54136

Indicators of Compromise

• Unexpected modifications to MCP configuration files in Cursor project directories
• Execution of suspicious processes spawned by the Cursor application
• Git commit history showing MCP configuration changes from unexpected contributors
• Unusual outbound network connections or command executions originating from the Cursor process

Detection Strategies

• Monitor file integrity of MCP configuration files (typically .cursor/ directory) for unauthorized modifications
• Implement git hooks to alert on changes to MCP configuration files in shared repositories
• Enable process monitoring to detect child processes spawned by Cursor that match known malicious patterns
• Review repository commit history for MCP configuration changes by untrusted contributors

Monitoring Recommendations

• Deploy endpoint detection solutions to monitor for suspicious process chains originating from code editor applications
• Implement file integrity monitoring on development workstations targeting Cursor configuration directories
• Enable audit logging for file modifications in user profile directories where Cursor stores configuration data
• Configure alerts for repository webhooks that trigger on changes to MCP-related configuration files

How to Mitigate CVE-2025-54136

Immediate Actions Required

• Upgrade Cursor to version 1.3 or later which contains the security fix
• Review all existing MCP configurations in shared repositories for unauthorized modifications
• Audit git history of MCP configuration files to identify potential tampering
• Temporarily disable or remove untrusted MCP configurations until upgrade is complete

Patch Information

Anysphere has released version 1.3 of Cursor which addresses this vulnerability. The fix implements proper content-based validation for MCP configurations, requiring user re-approval when configuration contents change. Users should update immediately through the Cursor application's built-in update mechanism or by downloading the latest version from the official website.

For detailed information about the vulnerability and patch, refer to the GitHub Security Advisory GHSA-24mc-g4xr-4395.

Workarounds

• Restrict write access to repositories containing MCP configurations to trusted contributors only
• Implement branch protection rules requiring code review for changes to MCP configuration files
• Use file system permissions to make MCP configuration files read-only after initial approval
• Consider disabling MCP functionality entirely until the patch can be applied in high-security environments
• Monitor MCP configuration directories for any file modifications using system-level file watching tools

# Example: Set MCP configuration files to read-only after approval
chmod 444 .cursor/mcp-config.json

# Example: Create a git pre-commit hook to warn on MCP config changes
# Add to .git/hooks/pre-commit
if git diff --cached --name-only | grep -q "mcp-config"; then
    echo "WARNING: MCP configuration file modified - review carefully"
    exit 1
fi