Prompt injection writes an MCP config that runs attacker code
CurXecute (CVE-2025-54135): Cursor let the agent create .cursor/mcp.json without approval, so injected text could add a server and get code execution.
- Agents
- Cursor
- Reported
- Source checked
- Tags
- mcp, rce, config-files
Symptom
A new .cursor/mcp.json appears in your workspace, and an MCP server you never added starts.
Cause
Editing an existing dotfile needed approval, but creating a new one didn't. An indirect prompt injection could create the MCP config and the command inside it would run.
Fix
Update Cursor to 1.3.9 or later, where writing MCP-sensitive files needs approval. Review any change to agent config files like code, and commit an empty MCP config so creation shows up as a diff.
# Pre-commit: flag changes to agent config files
git diff --cached --name-only | grep -E '(^|/)\.(cursor|vscode|claude)/|mcp\.json$' \
&& { echo 'Agent config changed: review it'; exit 1; } || true