Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M
CVE-2025-64106Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
High 8.8
In plain English
A high-severity OS command injection in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/cursor/cursor/security/advisories/GHSA-4575-fh42-7848 x_refsource_CONFIRM