Aggregator

Researchers have disclosed two vulnerabilities in Cursor, the popular AI-assisted code editor, that impact its handling of model context protocol (MCP) servers, which could be used to gain code execution on vulnerable systems.

Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two recently disclosed vulnerabilities in Cursor IDE.

What is Cursor?

Cursor is an AI-assisted integrated development environment (IDE), or AI code editor, developed by Anysphere. It was first released in March 2023.

Who uses Cursor?

In January 2025, Cursor had over 1 million users, according to a Bloomberg report. The company states that Cursor is used by over half of the Fortune 500, naming NVIDIA, Uber and Adobe among its customers.

What is CurXecute and MCPoison?

CurXecute and MCPoison are the names given to two separate vulnerabilities in Cursor.

What are the vulnerabilities associated with CurXecute and MCPoison?

The following are the CVEs assigned for both CurXecute and MCPoison:

When were these vulnerabilities first disclosed?

CurXecute (CVE-2025-54135) was disclosed on August 1 by researchers at AIM Security while MCPoison (CVE-2025-54136) was disclosed on August 5 by researchers at Check Point Research.

Were any of these vulnerabilities exploited as a zero-day?

No, these vulnerabilities were disclosed to Cursor by the respective researchers through coordinated disclosure on July 7 (CurXecute) and July 16 (MCPoison).

Are there any proofs-of-concept (PoCs) available for CurXecute and MCPoison?

Yes, the researchers have published PoC details on their respective blog posts, explaining how attackers could potentially exploit these flaws.

How severe are CurXecute and MCPoison?

Both vulnerabilities have the potential to be severe, but it is context dependent. The common thread between the two flaws is how Cursor handles interaction with MCP servers.

For a primer on MCP, read the blog Frequently Asked Questions About Model Context Protocol (MCP) and Integrating with AI for Agentic Applications. Additionally, Tenable Research has published investigations into MCP security, including MCP prompt injection and our discovery of a critical flaw in Anthropic MCP Inspector.

In the example outlined by AIM Security for CurXecute, an attacker could leverage prompt injection by targeting an MCP connected to a Slack instance, sending a crafted message that would be processed by the Slack MCP Server and read by Cursor to modify the underlying global mcp.json configuration settings even before the user has a chance to reject the suggested edits by AI. Crucially, Cursor would execute the command added to the modified MCP configuration immediately.

In the example outlined by Check Point Research for MCPoison, the flaw stems from the approval of an MCP server that contains a project-specific configuration (mcp.json). Once this MCP server has been approved by the target, any changes to the underlying configuration are considered trusted because it is bound by the MCP name not its contents. This would allow an attacker to modify the configuration to include malicious commands that would be executed silently and without requiring re-approval.

AI-assisted code editors help with the development of software but they introduce a new layer of risk. Whether through enabling MCP servers that could be vulnerable to prompt injection (CurXecute) or leveraging a seemingly harmless open-source project that is then compromised by a malicious contributor (MCPoison).

Are patches or mitigations available for CurXecute and MCPoison?

Yes, Cursor has released updated versions of its IDE to address both CurXecute and MCPoison.

Has Tenable released any product coverage for these vulnerabilities?

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages as they’re released:

• CVE-2025-54135
• CVE-2025-54136

This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Customers can also use our MCP Server Detected plugin to identify MCP server usage.

• When Public Prompts Turn Into Local Shells: ‘CurXecute’ – RCE in Cursor via MCP Auto‑Start
• MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass

Join Tenable's Research Special Operations (RSO) Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

网络空间风云诡谲，漏洞威胁如暗雷潜伏。盛邦安全一体化漏洞评估系统（RayScan）全新升级，依托AI智能检测引擎优化核心算法，性能翻倍、易用性飙升，帮助用户筑高安全基线。

 【第一方队：扫描能力全域进化 多场景全面覆盖】

1、多场景适应

实现对云计算平台、IoT设备、容器镜像、国产化软件等多种新型攻击面的深入扫描，确保对数字资产的全面覆盖。

2、闪电战

漏洞评估无上限，上万级资产普查无压力，高频巡检效率碾压传统工具。

 【第二方队漏洞态势一屏掌控 风险地图尽收眼底】

1、可视化呈现

全新漏洞-资产关联大屏，以资产风险分布视图、风险分布视图实时展示漏洞变化趋势、风险类别趋势。

2、智能作战沙盘

穿透式定位关键系统风险，直观呈现同一漏洞影响资产范围、同一风险类别影响资产范围、同一资产关联风险、同一端口关联风险，同一资产责任人/资产组关联风险等。

3、高效汇报

多维视图报告自动生成，灵活自定义报表满足不同角色需求，支持多种格式输出。

 【第三方队：化繁为简 人人可打胜仗】

1、精准研判

利用自然语言处理和语义理解技术，对漏洞描述、修复建议进行智能精炼与关联分析，降低技术门槛，提升判断效率。

2、智能装备

一键式漏洞工具，支持漏洞验证、自定义poc能力。

3、作战留痕

扫描日志实时监测，实时查看任务执行过程的日志信息，监控任务状态，满足等保2.0审计追溯要求。

4、向导式作战

提供快速上线向导，首次登录时能在快速向导指引下逐步完成部署配置。内置多种扫描策略，支持两高一弱、攻防演练、高危应急等多场景快速自检。

每一寸数字疆土，皆在RayScan锐眼之下！

原文链接

As the Pentagon grapples with the consequences of funding shortfalls and high turnover in the field of cybersecurity, Donald Trump’s inner circle is floating a bold proposal: the creation of a new combat branch—Cyber...

The post Trump’s Allies Propose New “Cyber Force” Military Branch to Combat Digital Threats appeared first on Penetration Testing Tools.

A recent automated study conducted by ETHIACK has revealed that modern web application security mechanisms—including widely adopted Web Application Firewalls (WAFs)—are vulnerable to a novel class of attacks that combine JavaScript injection with HTTP...

The post The WAF Deception: 70% of Firewalls Bypassed by HTTP Parameter Pollution and JS Injection appeared first on Penetration Testing Tools.

Amid the rapid proliferation of cryptocurrency ATMs across the United States, the Department of the Treasury has issued a warning about the growing risk of their exploitation for illicit purposes. In a recently published...

The post The Dark Side of Crypto ATMs: Treasury Warns of Rising Fraud and Scams as Losses Near $250M appeared first on Penetration Testing Tools.