{
 "type": "bundle",
 "id": "bundle--6fc82221-2f14-529d-af80-2239efac12b5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--85a4707d-2974-5c4d-b56c-b0b579dcdc25",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "CurXecute and MCPoison: prompt injection and config swaps turn Cursor's MCP support into code execution",
   "description": "Two flaws in the Cursor AI code editor's Model Context Protocol support. CurXecute (CVE-2025-54135, Aim Labs, CVSS 8.6): external content an MCP server ingests can prompt the agent to \"improve\" the project's .cursor/mcp.json, and Cursor ran the written config before the user accepted it — indirect prompt injection to remote code execution. MCPoison (CVE-2025-54136, Check Point, CVSS 7.2): once a user approves an MCP server entry, its command can later be swapped for a malicious one without re-prompting, giving persistent execution. Any third-party MCP server handling untrusted data (issue trackers, support tools, search engines) is a path in.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-011",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-011/"
    },
    {
     "source_name": "SecurityWeek",
     "url": "https://www.securityweek.com/several-vulnerabilities-patched-in-ai-code-editor-cursor/",
     "description": "Several Vulnerabilities Patched in AI Code Editor Cursor"
    },
    {
     "source_name": "SC World",
     "url": "https://www.scworld.com/news/cursor-flaw-risks-rce-from-prompt-injections-on-mcp-server-researchers-say",
     "description": "Cursor flaw risks RCE from prompt injections on MCP server, researchers say"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--1236415d-3e6e-5d4d-825e-e1e59e767dc5",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "Security researchers (Aim Labs; Check Point Research), proofs of concept",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ae06a915-722e-5595-b626-81d5ca4e7dc5",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "Cursor (Anysphere) — patched CurXecute in 1.3 and addressed the config-swap issue",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--687ea799-681a-5fed-b856-f7f168223ff5",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--2148704d-8518-54ed-b150-f08515e0e4a5",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "TA0002 Execution",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0002"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--8e8ebddd-e2d6-5155-96de-75ad1a6669c5",
   "created": "2025-08-04T00:00:00.000Z",
   "modified": "2025-08-04T00:00:00.000Z",
   "name": "TA0003 Persistence",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0003"
    }
   ]
  }
 ]
}