CVE Tools
Sign in

CVE-2025-54136

Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

Published: Aug 1, 2025Updated: Aug 25, 2025 Sources: CVE List NVD BDUCWE-78
7.2HIGH
NVD MITRE
EPSS Score
7.6%
Top 6.2%
CISA KEV
Not in KEV
Exploits
1 Known
Remediation
Patch Available
Self-Check
Not available

Description

Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3.

In plain language

AI Worth attention

CVE-2025-54136 lets an attacker slip in a malicious MCP server definition without triggering Cursor’s usual re-approval, which can lead to code running on your machine; if you use Cursor with MCP servers in shared repositories you collaborate on, you should update to Cursor 1.3.

Executive summary

In Cursor (1.2.4 and below), attackers with repo write access (or arbitrary local file-write) can modify already-approved MCP server definitions in a way that bypasses manual re-approvals, leading to remote and persistent code execution.

If affected, business impact
Full workstation compromisePersistent malicious accessOperational disruptionClient/customer data exposure

What to do now

  1. Check your installed Cursor version; if it is 1.2.4 or below, you are affected.
  2. If you work from shared Git repositories that include previously approved MCP server definitions, identify whether any collaborators (or anyone with repo write access) could modify those files.
  3. Update Cursor to version 1.3 or later.
  4. After updating, review your MCP server approvals (especially in shared repos) and remove/disable any unexpected MCP entries.
Patch / advisory Usually a quick update

CVSS Vector Breakdown

AV:NAC:LPR:HUI:NS:UC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:HPrivileges Required
High
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-78

Affected Products

anysphere
commercialaka anysphere ai
cursorSaaS
AI / ML / ai-agent-tooling
cursor
commercial·USaka cursor ai
cursorMixed
DevTools & CI / ide-editor
Anysphere, Inc.
commercial
CursorSaaS
Cloud & SaaS / saas-application

Exploitability

1 exploit source identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Official Patch Available
Is your org exposed to CVE-2025-54136?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique
Execution
View detailed technique mapping

References

https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395
github.com
https://github.com/PRE5T0/CVE-2025-54136
github.com
News mentions
3

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-54136 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows