AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

CursorGHSA-4hwr-97q3-37w2

Command Injection via Untrusted MCP Configuration in Cursor CLI Beta

Cursor

CVE-2025-64109 · Published Nov 3, 2025

High8.8
Fix: upgrade to 2025.09.17-25b418f or later
GitHub advisory

Summary

A vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs.

Remediation

MCP servers now prompt with a dialog before being enabled.

Affected versions

PackageAffectedFixed in
Cursor CLI (Beta)
Product
< 2025.09.17-25b418f2025.09.17-25b418f
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-78

More Cursor advisories

All Cursor
HighNov 3, 2025Cursorignore Bypass via New Cursorignore WriteCVE-2025-64110fixed in 2.0High 8.8Nov 3, 2025Speedbump Modal Bypass in Cursor MCP Server Deep-LinkCVE-2025-64106fixed in 2.0High 8.8Nov 3, 2025Sensitive File Modification - NTFS Path QuirksCVE-2025-64108fixed in 2.0High 8.8Nov 3, 2025Sensitive File Protection Bypass - Path Manipulation Using Backslashes on WindowsCVE-2025-64107fixed in 2.0High 7.1Oct 2, 2025Cursor CLI Agent - Sensitive File Overwrite BypassCVE-2025-61593fixed in 2025.09.17-25b418fHigh 8.0Oct 2, 2025Cursor IDE - Sensitive File Overwrite BypassCVE-2025-59944fixed in 1.7