Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M
CVE-2025-64109Cursor CLI Beta: Command Injection via Untrusted MCP Configuration
High 8.8
In plain English
A high-severity OS command injection in cursor from cursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/cursor/cursor/security/advisories/GHSA-4hwr-97q3-37w2 x_refsource_CONFIRM