Loading story…
Cursor released security updates for a high-severity vulnerability, tracked as CVE-2025-54136 and dubbed MCPoison, that affects versions earlier than 1.3. The flaw stems from how the AI code editor handles configuration changes for MCP (Model Context Protocol) servers, allowing a trust bypass that can lead to remote code execution and, in some cases, full system compromise.
Researchers reported that the issue can be triggered through tampered MCP configuration files on a victim machine or through modified files embedded in GitHub repositories opened by developers, creating a path to persistent code execution inside the development environment. Defenders were urged to upgrade Cursor to version 1.3 immediately and limit the IDE to connections with only trusted MCP servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK issued an advisory about CVE-2025-54136, warning that the vulnerability could be exploited through modified MCP configuration files on a victim device or in GitHub repositories in use. The notice recommended immediately upgrading to Cursor 1.3 and limiting connections to trusted MCP servers.
The developers of the Cursor AI code editor released security updates in Cursor version 1.3 to fix the high-severity vulnerability CVE-2025-54136, also called MCPoison. The flaw affects versions earlier than 1.3 and can enable remote code execution and full system compromise via MCP trust bypass.
Check Point Research published details on CVE-2025-54136, describing MCPoison as a persistent code execution issue in Cursor IDE caused by an MCP trust bypass. The publication publicly documented the vulnerability and its impact on Cursor users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 18, 2026
Researchers disclosed two critical vulnerabilities in the Cursor AI code editor, collectively named **DuneSlide** and tracked as `CVE-2026-50548` and `CVE-2026-50549`, that allow zero-click prompt-injection attacks to escape the IDE sandbox and achieve remote code execution on the underlying operating system. Both flaws carry a **CVSS 9.8** rating and affect Cursor versions prior to **3.0**, with exploitation enabling arbitrary file writes on a victim’s local system and potential compromise of linked SaaS workspaces. The attack chain abuses Cursor’s agent terminal command handling through working-directory manipulation and a symlink-based path resolution bypass, allowing attackers to overwrite the `cursorsandbox` helper and run arbitrary commands with the user’s privileges outside the sandbox. The issues were responsibly disclosed in February 2026 and fixed in Cursor **3.0**, released on April 2, 2026; while no active exploitation had been confirmed at publication, reporting warned the technique is highly automatable and organizations were urged to upgrade immediately and review any untrusted prompts or files processed before patching.
Jul 7, 2026
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026