Advisoriesby IbisSpeedbump Modal Bypass in Cursor MCP Server Deep-Link
Summary
A input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server.
Details
Cursor implements critical security controls when installing MCP servers via deep-links. The intended behavior shows users:
1. A prominent warning message (red alert box) stating: "Installing an MCP server will execute commands with the same privileges as your user. Only proceed if you fully trust the server source and understand the implications."
2. Complete visibility of the command and arguments that will be executed,
the server name and type
Instead, with this vulnerability, after a victim receives and clicks a malicious deep-link, Cursor displays what appears to be a legitimate Playwright MCP server installation dialog. The victim, seeing the trusted Playwright branding and benign "browser integration" messaging, clicks Install. However, this is not installing Playwright at all - it's executing arbitrary commands from the deeplink. The victim has no visibility into the actual commands being executed and no indication that anything malicious is occurring.
Impact
If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Cursor Product | < 2.0 | 2.0 |
Details and references
### Summary A input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. ### Details Cursor implements critical security controls when installing MCP servers via deep-links. The intended behavior shows users: 1. A prominent warning message (red alert box) stating: "Installing an MCP server will execute commands with the same privileges as your user. Only proceed if you fully trust the server source and understand the implications." 2. Complete visibility of the command and arguments that will be executed, the server name and type Instead, with this vulnerability, after a victim receives and clicks a malicious deep-link, Cursor displays what appears to be a legitimate Playwright MCP server installation dialog. The victim, seeing the trusted Playwright branding and benign "browser integration" messaging, clicks Install. However, this is not installing Playwright at all - it's executing arbitrary commands from the deeplink. The victim has no visibility into the actual commands being executed and no indication that anything malicious is occurring. ### Impact If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink. ### Remediation The parsing logic for detecting trusted MCP servers has been fixed.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78