{
 "id": "TR-2026-011",
 "status": "published",
 "title": "CurXecute and MCPoison: prompt injection and config swaps turn Cursor's MCP support into code execution",
 "date": "2025-08-04",
 "window": "Patched in Cursor 1.3 (CurXecute); both reported around early Aug 2025",
 "ai_role": "target",
 "category": "red_team",
 "summary": "Two flaws in the Cursor AI code editor's Model Context Protocol support. CurXecute (CVE-2025-54135, Aim Labs, CVSS 8.6): external content an MCP server ingests can prompt the agent to \"improve\" the project's .cursor/mcp.json, and Cursor ran the written config before the user accepted it — indirect prompt injection to remote code execution. MCPoison (CVE-2025-54136, Check Point, CVSS 7.2): once a user approves an MCP server entry, its command can later be swapped for a malicious one without re-prompting, giving persistent execution. Any third-party MCP server handling untrusted data (issue trackers, support tools, search engines) is a path in.",
 "attacker": {
  "description": "Security researchers (Aim Labs; Check Point Research), proofs of concept"
 },
 "defender": {
  "description": "Cursor (Anysphere) — patched CurXecute in 1.3 and addressed the config-swap issue"
 },
 "scale": "Developer machine: arbitrary code execution in the editor's context",
 "impact": "Remote and persistent code execution via MCP configuration",
 "tactics": [
  "TA0001",
  "TA0002",
  "TA0003"
 ],
 "timeline": [
  {
   "date": "2025-08-04",
   "text": "SecurityWeek reports both CVEs patched; Aim Labs names CVE-2025-54135 CurXecute, Check Point names CVE-2025-54136 MCPoison",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "A config file an agent can edit is executable surface; don't run a written MCP config before the user has approved that exact content.",
  "Approval must bind to the content, not the entry — if an approved server's command can later change silently, the approval is meaningless (MCPoison).",
  "Any MCP server that reads untrusted data extends the injection surface into the editor."
 ],
 "models_named": [],
 "related_agents": [],
 "cves": [
  "CVE-2025-54135",
  "CVE-2025-54136"
 ],
 "vendor_response": "Cursor 1.3 and subsequent fixes",
 "sources": [
  {
   "title": "Several Vulnerabilities Patched in AI Code Editor Cursor",
   "url": "https://www.securityweek.com/several-vulnerabilities-patched-in-ai-code-editor-cursor/",
   "outlet": "SecurityWeek",
   "date": "2025-08-04"
  },
  {
   "title": "Cursor flaw risks RCE from prompt injections on MCP server, researchers say",
   "url": "https://www.scworld.com/news/cursor-flaw-risks-rce-from-prompt-injections-on-mcp-server-researchers-say",
   "outlet": "SC World",
   "date": "2025-08"
  }
 ],
 "reviewer": null,
 "checked_on": null
}