Cursor AI code editor patches CurXecute prompt-injection RCE flaw

Cursor's AI coding agent could be hijacked into executing attacker-controlled commands through a single externally hosted prompt injection, researchers at AimLabs disclosed.

The flaw, tracked as CVE-2025-54135, was reported to Cursor on July 7 and a patch was included in an update one day later for version 1.3 of Cursor.

What happened

The vulnerability occurs when Cursor interacts with a Model Context Protocol server used to reach external tools such as Slack and GitHub.

Researchers injected a malicious prompt through Slack, which was fetched by Cursor through a connected MCP server.

The prompt altered Cursor's configuration file, causing it to add another server with a malicious start command.

Cursor executed the malicious commands the moment the edits were made, before the user could reject the suggestion.

Impact

Exploiting the flaw let an attacker influence Cursor, which has developer-level privileges on host devices, in ways that are nearly silent and invisible to the user.

AimLabs said the tools expose the agent to external and untrusted data that can affect its control-flow.

That exposure allows attackers to hijack the agent's session and take advantage of its privileges on behalf of the user.

Researchers summarized the risk, noting that a single poisoned document can morph an AI agent into a local shell.

Response

AimLabs said all previous versions of the software remain susceptible to remote-code execution triggered by a single externally hosted prompt injection, according to its blog post, with the fix landing only in version 1.3.

Lessons for security leaders

AimLabs said this type of flaw is inextricably tied to the way most large language models operate, ingesting commands and direction in the form of external prompting.

The researchers said they believe it's likely that most major models will continue to be vulnerable to similar variants of the same problem.

AimLabs concluded that because model output steers the execution path of any AI agent, this vulnerability pattern is intrinsic and keeps resurfacing across multiple platforms.

Security leaders deploying agentic coding tools should treat MCP server connections and any externally fetched content as untrusted input capable of triggering unreviewed actions on developer machines.