Cursor Agent is vulnerable to prompt injection via MCP Special Files

published 2025-08-05 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-23569

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.1%; EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits: 0; none known

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.

Patch / fix

fixed in 1

anysphere cursor 1.3.9

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 15 mo ago (2025-08-05)

Exploit prediction

2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

cursor cursor

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

github.com /cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm
mitigation, vendor-advisory

Sources

CVE List CVE-2025-54135
NVD CVE-2025-54135

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary