CVE-2025-54135CWE-78CWE-829

Cursor Agent is vulnerable to prompt injection via MCP Special Files

High · published August 5, 2025

CVSS v3.1
8.6
EPSS
2%
Percentile
78.5
In the wild
Unconfirmed
What it is

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01810 · 78.5th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2025-08-05T00:11Z
EPSS history
Timeline
  • 05 AUG 00:11Z
    Cursor Agent is vulnerable to prompt injection via MCP Special Files
    cvelistv5