# Cursor CLI MCP Config RCE - Repo-Local mcp.json Command Execution

- **Severity:** High
- **Signature ID:** `6f3c1a9e-8b47-4d2e-9f05-3c7a1b6e4d82`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0011 (User Execution)
- **OWASP:** LLM03 (Supply Chain), ASI02 (Tool Misuse and Exploitation)

## Summary

Older versions of Cursor CLI Beta automatically launch any MCP server declared in a project's .cursor/mcp.json file without asking for permission. If an attacker gets a victim to clone or open a booby-trapped repository, whatever command is in that config file runs immediately.

## How the attack works

An attacker crafts a repository containing a .cursor/mcp.json file whose MCP server entry is really a disguised execution payload - a shell command, an inline script passed to an interpreter, a downloader, a base64-encoded blob, or a package runner like npx/uvx/bunx/dlx. The victim clones or opens the repository in Cursor CLI Beta (before version 2025.09.17-25b418f). Cursor reads the local mcp.json and starts the declared stdio MCP server with no consent prompt, executing the attacker's command. A related, narrower pattern is a command line that both references the MCP config and pipes a download directly into an interpreter, which is a common shape for weaponized configs.

## Why it matters

Opening a malicious repository can lead to immediate arbitrary code execution on the developer's machine, with no user interaction beyond opening the project.

## What you can do

- Update Cursor CLI to 2025.09.17-25b418f or later, which requires consent before launching repo-declared MCP servers.
- Review .cursor/mcp.json in any repository before opening it in Cursor, especially repos from untrusted or external sources.
- Treat repo-local MCP server definitions as executable code and subject them to the same review as build scripts or CI configs.
- Watch for process launches that combine an MCP config reference with shell execution flags, base64 decoding, or download-to-interpreter pipelines, and investigate ones you can't attribute to intentional config authoring or scaffolding.

## Known benign look-alikes

- A developer intentionally authoring or repairing their own .cursor/mcp.json with a shell redirect, tee, or an editor helper that passes the config path on the command line.
- Project scaffolding tools (npx/uvx/pnpm dlx create-*) that generate a Cursor MCP configuration as part of first-time repository setup.
- Locally vetted stdio MCP servers that are legitimately launched through npx or uvx and happen to carry the config path in their argv for logging or --config purposes.
- Security engineering and rule-validation harnesses replaying the Cursor CLI proof of concept in an isolated lab.
- Onboarding or documentation walkthroughs where an engineer pastes a documented MCP install one-liner into a terminal.

## References

- https://cursor.com/security
- https://modelcontextprotocol.io/docs/concepts/architecture
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1195/

---
Source: https://www.netzilo.com/threats/cursor-cli-mcp-config-rce