Traces / TR-2026-011
CurXecute and MCPoison: prompt injection and config swaps turn Cursor's MCP support into code execution
Two flaws in the Cursor AI code editor's Model Context Protocol support. CurXecute (CVE-2025-54135, Aim Labs, CVSS 8.6): external content an MCP server ingests can prompt the agent to "improve" the project's .cursor/mcp.json, and Cursor ran the written config before the user accepted it — indirect prompt injection to remote code execution. MCPoison (CVE-2025-54136, Check Point, CVSS 7.2): once a user approves an MCP server entry, its command can later be swapped for a malicious one without re-prompting, giving persistent execution. Any third-party MCP server handling untrusted data (issue trackers, support tools, search engines) is a path in.
Timeline
What defenders can take from it
- A config file an agent can edit is executable surface; don't run a written MCP config before the user has approved that exact content.
- Approval must bind to the content, not the entry — if an approved server's command can later change silently, the approval is meaningless (MCPoison).
- Any MCP server that reads untrusted data extends the injection surface into the editor.
The maintainer's reading of the public reports, not advice specific to your deployment.
Sources · 2
- Several Vulnerabilities Patched in AI Code Editor Cursor — SecurityWeek, 2025-08-04 ○ On 2026-10-26, this link could not be verified (bot wall).
- Cursor flaw risks RCE from prompt injections on MCP server, researchers say — SC World, 2025-08 ○ On 2026-10-26, this link could not be verified (bot wall).
Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.
Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.