Cursor MCP Deep-Link Install Bypass

How the attack works

An attacker sends or embeds a cursor:// deep-link containing an MCP server install request. The link's query parameters are obfuscated -- encoded control characters, double-encoding, nested URL schemes, or duplicated parameters -- so Cursor's install confirmation dialog is skipped or shows something other than what will actually run. The server config hidden in the link (plaintext or base64-encoded) specifies a raw shell interpreter or a one-liner that downloads and executes further code. Once the victim's Cursor client processes the link, that command runs. A related but separate pattern catches the same final step directly: a JSON MCP server config appearing on a command line alongside a hard download-and-execute or decode-and-execute payload, which is what happens right after the link is accepted.

Netzilo detection

Why it matters

A single click on a malformed link can lead to arbitrary code execution on a developer's machine under the guise of a routine MCP tool install, giving an attacker a foothold via the developer's environment, credentials, and source code access.

What you can do

• →Update Cursor past version 1.7.28, where this input-validation bypass was present.
• →Treat cursor:// mcp/install links from untrusted sources (chat messages, issues, READMEs, emails) as executable code, not as documentation links.
• →Inspect any MCP server config before accepting an install prompt; do not accept configs whose command is a raw shell interpreter or a curl/wget-style download-and-run one-liner.
• →Restrict or monitor process execution from the Cursor application, and alert on child processes invoking shells with download-and-execute patterns.

Known benign look-alikes

• Security researchers or red teams reproducing the published Cursor deep-link install-bypass proof of concept on a test machine -- the command line is identical to the real attack and this rule is expected to fire.
• Detection engineers or IR analysts grepping logs, opening rule files, or catting a PoC file that embeds the deep-link string -- suppressed by filter_inspection when the inspecting binary is argv[0].
• Vendor documentation, blog posts or onboarding scripts that embed an example cursor:// mcp/install link with a templated config -- suppressed by filter_placeholder.
• An internally approved MCP server whose bootstrap genuinely pipes an installer to a shell on the same command line as its JSON config (post-acceptance branch only); surfaces as a report and should be tuned per environment, not silently trusted.
• Deep-links containing a percent-encoded newline or tab because the surrounding tooling URL-encoded an entire multi-line snippet rather than a single argument.

References

• https://attack.mitre.org/techniques/T1204/001/
• https://attack.mitre.org/techniques/T1059/
• https://genai.owasp.org/llm-top-10/

Related threats