CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)
A bug in Cursor IDE (before version 1.3.9) let attackers get code executed just by getting text into the AI agent's context — no user approval needed. The trick abuses Cursor's habit of instantly launching any server listed in its mcp.json config file the moment that file is edited, even before a human confirms the change.
How the attack works
An attacker plants malicious instructions somewhere the Cursor agent will read them — a Slack message pulled in via a Slack integration, a poisoned GitHub issue, or similar untrusted content. The hidden instructions tell the agent to 'improve' or add an entry to .cursor/mcp.json, specifying a command that runs attacker code, such as a curl-pipe-to-bash download or a reverse shell. Cursor starts any server listed in mcp.json the instant the file is written, so the malicious command executes immediately — before the user sees or approves the edit. Even if the user later rejects the suggested change, the damage is already done because execution happened at write time, not at approval time.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 50ccfd9b-4293-48a2-ac0b-805f4c8b629b
- Severity
- High
- CVEs
- CVE-2025-54135
Why it matters
An attacker gets arbitrary code execution on the developer's machine through content the developer never directly typed or approved, potentially leading to credential theft, backdoors, or further compromise of the developer's environment.
What you can do
- →Upgrade Cursor to version 1.3.9 or later, which requires explicit approval before any mcp.json change takes effect.
- →Treat any content pulled into the agent from Slack, issues, or other external sources as untrusted, and review agent-proposed file edits before they run.
- →Restrict or monitor writes to .cursor/mcp.json (both workspace and global) and review it for unexpected server entries.
- →Watch for MCP server commands containing shell payload patterns like curl|bash, base64-decode-and-execute, or drop-and-run scripts.
Known benign look-alikes
- Legitimate documentation or setup guides showing how to add a well-known MCP server to .cursor/mcp.json (e.g. the official filesystem or github server via npx) where the command is a normal package launcher and there is no embedded shell payload (curl|bash, reverse shell, base64|sh, or a drop-and-run). The rule requires the mcp.json/Cursor-config anchor to co-occur with an executable-shell-payload construct, not merely a benign npx/uvx launcher.
- Advisory/patch-note text naming CVE-2025-54135, CurXecute, or the .cursor/mcp.json auto-start behavior without carrying a live injected server entry that runs a shell payload.
- A user manually editing their own mcp.json to add a trusted server; this rule targets injected directives that combine a write-to-mcp.json instruction with an attacker shell command, which legitimate self-edits do not.