Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)
AI coding tools like Cursor, Windsurf, Claude Code, Gemini CLI, and GitHub Copilot use a config file (mcp.json) to launch helper tools called MCP servers. If an attacker can plant or modify that file, the IDE will run whatever command is listed the moment a developer opens the project — no click, no prompt, no warning.
How the attack works
An attacker slips a malicious mcp.json into a project via a poisoned npm package post-install script, a bad commit to .vscode/.cursor folders, or a booby-trapped repo template. Some IDEs load this config automatically on workspace open and treat its 'command' and 'args' fields as literal instructions to run on the operating system. In the Windsurf variant, the attacker doesn't even need direct file write access — HTML content rendered by the IDE can trigger the same write. Either way, the config gets loaded, the malicious command executes, and the developer never sees a consent dialog.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 83f118ff-7186-4532-a881-83fcf2a72c86
- Severity
- Critical
Why it matters
An attacker gets arbitrary code execution on a developer's machine simply by getting them to open a project folder, which can lead to credential theft, further supply chain compromise, or full workstation takeover.
What you can do
- →Treat mcp.json (and any auto-loaded IDE config file) as executable code, not documentation — review it in code review like you would a build script.
- →Block or flag commits that add or modify .cursor/.vscode/MCP config files from untrusted contributors or templates.
- →Audit npm and other package post-install scripts for writes to IDE config directories before allowing them in your build pipeline.
- →Disable auto-loading of workspace MCP configs where the IDE allows it, or require explicit approval before a new MCP server command is run.
Known benign look-alikes
- Legitimate MCP setup documentation showing example .cursor/mcp.json layouts.
- Open-source MCP server READMEs that include example config snippets for users to copy.
- Internal team templates that include reviewed mcp.json fixtures with known-safe commands (npx + MCP package).