CVE-2025-64109: Cursor CLI Beta: Command Injection via Untrusted MCP Configuration
Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64109?
CVE-2025-64109 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-64109?
To mitigate CVE-2025-64109, update your Cursor CLI Beta to a version later than 2025.09.17-25b418f.
Who is affected by CVE-2025-64109?
CVE-2025-64109 affects users of Cursor CLI Beta prior to version 2025.09.17-25b418f.
What kind of attack does CVE-2025-64109 enable?
CVE-2025-64109 allows attackers to execute arbitrary code remotely through uploading a malicious MCP configuration.
What does MCP stand for in relation to CVE-2025-64109?
In CVE-2025-64109, MCP stands for Model Context Protocol, which is the mechanism exploited for the vulnerability.