Modification of MCP Server Definitions Bypasses Manual Re-approval

Summary

A vulnerability in Cursor AI allows an attacker to achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt.

Impact

If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution.

Remediation

Cursor now requires user approval every time an mcpServer entry is modified (in addition to the existing behavior of asking for approval when a new server is added).