CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog
Attackers can execute arbitrary system commands via malicious deeplinks because the installation dialog hides command arguments, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-54133?
CVE-2025-54133 is a medium-severity command injection vulnerability in cursor, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When users click malicious `cursor://anysphere.cursor-deeplink/mcp/install` links, the installation dialog does not show the arguments being passed to the command being run. If a user clicks a malicious deeplink, then examines the installation dialog and clicks through, the full command including the arguments will be executed on the machine. This is fixed in version 1.3.
Which versions are affected by CVE-2025-54133?
It affects 1 product.
Products include Anysphere Cursor.
How do I fix CVE-2025-54133?
No fix has been published for CVE-2025-54133 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-54133 being exploited?
There is no known exploitation of CVE-2025-54133 in the wild and no public exploit code.
Other vulnerabilities in cursor
- CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
- CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
- CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
- CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
- CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks