Cursor CLI MCP Config RCE - Repo-Local mcp.json Command Execution

How the attack works

An attacker crafts a repository containing a .cursor/mcp.json file whose MCP server entry is really a disguised execution payload - a shell command, an inline script passed to an interpreter, a downloader, a base64-encoded blob, or a package runner like npx/uvx/bunx/dlx. The victim clones or opens the repository in Cursor CLI Beta (before version 2025.09.17-25b418f). Cursor reads the local mcp.json and starts the declared stdio MCP server with no consent prompt, executing the attacker's command. A related, narrower pattern is a command line that both references the MCP config and pipes a download directly into an interpreter, which is a common shape for weaponized configs.

Netzilo detection

Why it matters

Opening a malicious repository can lead to immediate arbitrary code execution on the developer's machine, with no user interaction beyond opening the project.

What you can do

• →Update Cursor CLI to 2025.09.17-25b418f or later, which requires consent before launching repo-declared MCP servers.
• →Review .cursor/mcp.json in any repository before opening it in Cursor, especially repos from untrusted or external sources.
• →Treat repo-local MCP server definitions as executable code and subject them to the same review as build scripts or CI configs.
• →Watch for process launches that combine an MCP config reference with shell execution flags, base64 decoding, or download-to-interpreter pipelines, and investigate ones you can't attribute to intentional config authoring or scaffolding.

Known benign look-alikes

• A developer intentionally authoring or repairing their own .cursor/mcp.json with a shell redirect, tee, or an editor helper that passes the config path on the command line.
• Project scaffolding tools (npx/uvx/pnpm dlx create-*) that generate a Cursor MCP configuration as part of first-time repository setup.
• Locally vetted stdio MCP servers that are legitimately launched through npx or uvx and happen to carry the config path in their argv for logging or --config purposes.
• Security engineering and rule-validation harnesses replaying the Cursor CLI proof of concept in an isolated lab.
• Onboarding or documentation walkthroughs where an engineer pastes a documented MCP install one-liner into a terminal.

References

• https://cursor.com/security
• https://modelcontextprotocol.io/docs/concepts/architecture
• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1195/

Related threats