Critical RCE Vulnerability Discovered in Cursor AI Code Editor

TL;DR

• A high-severity vulnerability (CVE-2025-54136) in the Cursor AI code editor can lead to remote code execution.
• Dubbed MCPoison, this flaw exploits how the software handles modifications to Model Configuration Protocol (MCP) files.
• Immediate updates and security measures are recommended to mitigate potential risks.

Introduction

Cybersecurity researchers have uncovered a significant security vulnerability in the AI-powered code editor, Cursor. This flaw, identified as CVE-2025-54136 with a CVSS score of 7.2, poses a high risk as it could allow remote code execution (RCE). The vulnerability has been codenamed MCPoison by Check Point Research due to its exploitation of how the software manages modifications to Model Configuration Protocol (MCP) files.

Understanding the Vulnerability

What is CVE-2025-54136?

CVE-2025-54136 is a critical security flaw that affects the Cursor AI code editor. This vulnerability allows attackers to execute arbitrary code on a victim’s machine by manipulating MCP files. The severity of this vulnerability is underscored by its CVSS score of 7.2, indicating a high level of risk.

How Does MCPoison Work?

The MCPoison vulnerability exploits a specific quirk in the way Cursor handles modifications to MCP files. These files are essential for the configuration and operation of the AI models within the editor. By swapping these files with malicious versions post-approval, attackers can gain control over the system, leading to remote code execution.

Implications of the Vulnerability

Potential Risks

The exploitation of this vulnerability can have severe consequences, including:

• Unauthorized Access: Attackers can gain unauthorized access to sensitive information.
• System Compromise: The integrity of the affected systems can be compromised, leading to further attacks.
• Data Breaches: Sensitive data can be exposed or stolen, leading to potential data breaches.

Affected Systems

All versions of the Cursor AI code editor prior to the latest security update are vulnerable to this exploit. Users are strongly advised to update their software to the latest version to mitigate the risk.

Mitigation and Prevention

Immediate Actions

To protect against this vulnerability, users should:

1. Update Software: Ensure that the Cursor AI code editor is updated to the latest version.
2. Monitor Systems: Regularly monitor systems for any unusual activity that may indicate an exploit attempt.
3. Implement Security Measures: Use additional security measures such as firewalls and intrusion detection systems to provide an extra layer of protection.

Long-Term Strategies

For long-term protection, consider the following strategies:

• Regular Audits: Conduct regular security audits to identify and address potential vulnerabilities.
• Employee Training: Provide training for employees on recognizing and responding to security threats.
• Incident Response Plan: Develop and maintain an incident response plan to quickly address any security breaches.

Conclusion

The discovery of the MCPoison vulnerability in the Cursor AI code editor highlights the ongoing challenges in cybersecurity. Immediate action is required to update and secure affected systems to prevent potential exploitation. By staying informed and proactive, users can better protect their systems from such vulnerabilities.

Additional Resources

For further insights and updates on this vulnerability, refer to the following resources:

• The Hacker News Article on Cursor AI Vulnerability
• Check Point Research on MCPoison

Stay vigilant and ensure your systems are protected against this critical vulnerability.