CVEs / CVE-2025-54136
CVE-2025-54136
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| Cursor | < 1.3 | 1.3 |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- TR-2026-011 CurXecute and MCPoison: prompt injection and config swaps turn Cursor's MCP support into code execution — a public trace that names this CVE
References · 1
- github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395 — Vendor Advisory
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-25 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.