{
 "public_id": "AIR-2025-0080",
 "incident_id": "2025-08-cursor-curxecute",
 "date_disclosed": "2025-08-05",
 "date_occurred": null,
 "title": "CurXecute (CVE-2025-54135): indirect prompt injection writes Cursor's mcp.json and gets RCE with no approval",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_via_mcp_tool_output",
 "agent_capability_abused": [
  "file_write",
  "mcp_config_autoload",
  "tool_invocation",
  "mcp_tool_use",
  "config_modification",
  "shell_execution"
 ],
 "target_product": "Cursor IDE",
 "target_vendor": "Anysphere (Cursor)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "developer_machine_compromise"
 ],
 "blast_radius": "all Cursor installs below 1.3.9 whose agent read attacker-controlled external content (e.g. a Slack message via the Slack MCP server)",
 "cve": [
  "CVE-2025-54135"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "indirect_prompt_injection",
   "config_file_write",
   "approval_bypass",
   "mcp_config",
   "mcp_auto_start",
   "developer_privileges"
  ]
 },
 "defense_present": "user approval required to edit existing dotfiles",
 "defense_bypassed": true,
 "fix_shipped": "Cursor 1.3 / 1.3.9 (July 29, 2025)",
 "primary_sources": [
  "https://www.tenable.com/cve/CVE-2025-54135",
  "https://www.catonetworks.com/blog/curxecute-rce/",
  "https://thehackernews.com/2025/08/cursor-ai-code-editor-fixed-flaw.html"
 ],
 "verified_quote": "Cursor allows writing in-workspace files with no user approval in versions below 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval.",
 "confidence": "high",
 "notes": "Named CurXecute by Aim Labs (Aim Security), the same team behind EchoLeak. CVSS v3 9.8 per the CVE record; Tenable's FAQ cites 8.6. The Cato Networks blog on this vulnerability serves no article text, so the quote is the CVE record text reproduced on Tenable's CVE page. Patch merged 2025-07-08, shipped in Cursor 1.3 on 2025-07-29, public 2025-08-05. Also reported as: 'CurXecute: RCE in Cursor via prompt-injected writes to mcp.json'.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Prompt Injection",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent wrote mcp.json and executed with no approval",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_via_mcp_tool_output",
 "guardrail_kind": [
  "human_approval"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [
   "CVE-2025-54135"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}