CVE-2025-54135: Cursor Agent is vulnerable to prompt injection via MCP Special Files
No fix listed · Affected: cursor · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub4 Aug 2025
- Not established: not seen
Higher than 82% of scored CVEs
DescriptionNVD
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- cursor
- Published
- August 2025
What changed
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
CoverageNo articles yet
No CyberSIXT article names CVE-2025-54135 yet. New articles appear here and in the RSS feed.