Read the docs
TI-2025-39560 Aliases CVE-2025-64109

Cursor CLI Beta: Command Injection via Untrusted MCP Configuration

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed cursor (cursor): 2025.09.17-25b418f

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cursorcursorbefore 2025.09.17-25b418f2025.09.17-25b418fPatch availableCNA
  • cursor Vendorcursor Affected before 2025.09.17-25b418f Fixed in 2025.09.17-25b418f Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*——cursor
  • cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:* Versions — — ·cursor

Remediation

  • Fix · CNA cursor (cursor) Fixed in 2025.09.17-25b418f

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64109

References

Other 1

  • TI-2026-45043 Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace CVSS 4.0HIGH 8.7
  • TI-2025-33979 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals CVSS 3.1HIGH 8.8
  • TI-2025-38624 OS command injection in cursor CVSS 3.1CRITICAL 9.8
  • TI-2026-37271 Cursor Desktop sandbox escape via symlink and failed path canonicalization CVSS 4.0CRITICAL 9.3
  • TI-2026-37270 Cursor Desktop sandbox escape via agent-controlled working directory CVSS 4.0CRITICAL 9.3
  • TI-2025-38037 Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution CVSS 3.1HIGH 8.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences