CVE-2025-64109 Cursor CLI Beta: Command Injection via Untrusted MCP Configuration
Attackers can execute arbitrary code by tricking users into opening a malicious repository with Cursor CLI, which auto-runs untrusted MCP server commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-64109?
CVE-2025-64109 is a high-severity command injection vulnerability in cursor, published on 4 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f.
Weakness: CWE-78
Which versions are affected by CVE-2025-64109?
How do I fix CVE-2025-64109?
No fix has been published for CVE-2025-64109 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-64109 being exploited?
There is no known exploitation of CVE-2025-64109 in the wild and no public exploit code.