Arbitrary code execution from Cursor Agent through a prompt injection via MCP Special Files

Summary

Cursor allows writing in-workspace files with no user approval. If the file is a dotfile, editing it requires approval but creating one if it doesn't exists doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval.

Impact

If chained with a separate prompt injection vulnerability, this could allow the writing of sensitive MCP files on the host by the agent. This can then be used to directly execute code by adding it as a new MCP server.

Remediation

The agent has been blocked from writing MCP-sensitive files without approval.