CVE-2025-54133: Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog
Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When users click malicious cursor://anysphere.cursor-deeplink/mcp/install links, the installation dialog does not show the arguments being passed to the command being run. If a user clicks a malicious deeplink, then examines the installation dialog and clicks through, the full command including the arguments will be executed on the machine. This is fixed in version 1.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54133?
CVE-2025-54133 is classified as a high severity vulnerability due to its potential for arbitrary system command execution.
How do I fix CVE-2025-54133?
To fix CVE-2025-54133, upgrade Cursor to the latest version beyond 1.2.
What versions of Cursor are affected by CVE-2025-54133?
CVE-2025-54133 affects Cursor versions between 1.17 and 1.2 inclusive.
What type of vulnerability is CVE-2025-54133?
CVE-2025-54133 is a UI information disclosure vulnerability.
Can attackers exploit CVE-2025-54133 without user interaction?
No, attackers require user interaction through social engineering to exploit CVE-2025-54133.