CVE-2025-54135 Cursor Agent is vulnerable to prompt injection via MCP Special Files
Attackers can achieve remote code execution by exploiting prompt injection to write malicious MCP configuration files without user approval.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54135?
CVE-2025-54135 is a high-severity code injection vulnerability in cursor, published on 5 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Which versions are affected by CVE-2025-54135?
It affects 1 product.
Products include Anysphere Cursor.
How do I fix CVE-2025-54135?
No fix has been published for CVE-2025-54135 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-54135 being exploited?
There is no known exploitation of CVE-2025-54135 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in cursor
- CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
- CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
- CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
- CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
- CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks