CVE-2025-64109: 
Cursor IDE vulnerability analysis and mitigation

CVE-2025-64109 is a command injection vulnerability in the Cursor CLI Beta (an AI-powered code editor) that allows remote code execution via a malicious MCP (Model Context Protocol) configuration file. An attacker can plant a crafted .cursor/mcp.json file in a GitHub repository; when a victim clones and opens the project with Cursor CLI, the malicious MCP server command executes immediately without any user warning. All Cursor CLI Beta versions prior to 2025.09.17-25b418f are affected. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of special elements used in an OS command (CWE-78), specifically within the Cursor CLI Beta's handling of MCP server configurations defined in .cursor/mcp.json. When Cursor CLI opens a project directory, it reads and automatically executes the MCP server startup command specified in this configuration file without prompting the user or validating the command's origin or content. An attacker with the ability to commit to or create a public/private GitHub repository can embed an arbitrary OS command as the MCP server invocation, which is then executed in the victim's local environment upon project open. No privileges are required on the attacker's side, and exploitation requires only that the victim clone and open the repository with the vulnerable Cursor CLI (GitHub Advisory).

Successful exploitation grants an attacker arbitrary code execution on the victim's machine with the privileges of the user running Cursor CLI. This can result in full confidentiality, integrity, and availability compromise of the victim's system — including unauthorized access to source code, credentials, and secrets stored in the development environment, installation of malware or backdoors, data theft or manipulation, and potential lateral movement within the victim's network. The attack surface is particularly significant for developers who routinely clone open-source or third-party repositories (GitHub Advisory, Red Hat CVE).

As of the time of publication, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.166%, indicating a currently low probability of exploitation in the near term. However, the attack is conceptually straightforward — requiring only a malicious repository and a victim using the vulnerable Cursor CLI — which lowers the practical barrier for exploitation. The vulnerability was reported by researcher avivdon and disclosed via GitHub Security Advisory on November 3, 2025 (GitHub Advisory).

1. Prepare malicious repository: Create or fork a GitHub repository and add a .cursor/mcp.json file containing a malicious MCP server configuration where the server startup command is replaced with an arbitrary OS command (e.g., a reverse shell, data exfiltration script, or malware dropper).
2. Distribute the repository: Share the repository link via social engineering, open-source contribution invitations, dependency confusion, or by making it appear as a legitimate project to attract developer victims.
3. Victim clones the repository: The victim runs git clone <malicious-repo-url> on their local machine.
4. Victim opens project with Cursor CLI: The victim opens the cloned directory using the vulnerable Cursor CLI Beta (any version prior to 2025.09.17-25b418f).
5. Automatic command execution: Cursor CLI reads .cursor/mcp.json and immediately executes the attacker-specified MCP server command without displaying any warning or confirmation prompt, achieving arbitrary code execution in the victim's user context (GitHub Advisory).

• File System: Presence of a .cursor/mcp.json file in a cloned repository containing unexpected or obfuscated command strings in MCP server configuration fields; newly created files, scripts, or binaries in the user's home directory or temp folders shortly after opening a project in Cursor CLI.
• Process: Unexpected child processes spawned by the Cursor CLI process (e.g., bash, sh, cmd.exe, powershell, curl, wget, python, node) executing commands not initiated by the user; reverse shell connections or unusual outbound network activity originating from the Cursor process.
• Network: Outbound connections to unfamiliar IP addresses or domains initiated by the Cursor CLI process or its child processes shortly after opening a repository; DNS queries for attacker-controlled infrastructure.
• Logs: Shell history or audit logs showing execution of unexpected commands at the time a Cursor project was opened; system logs recording new process creation events tied to the Cursor CLI parent process (GitHub Advisory).

The vulnerability is fixed in Cursor CLI Beta version 2025.09.17-25b418f, which introduces a confirmation dialog prompting users before any MCP server is enabled, preventing silent automatic execution of MCP configurations (GitHub Advisory). Users should immediately upgrade to this version or later. As interim workarounds: avoid cloning and opening repositories from untrusted or unknown sources with Cursor CLI; manually inspect .cursor/mcp.json files in any cloned repository before opening the project; and implement code review processes that flag unexpected configuration files in repositories.

The vulnerability was published via GitHub Security Advisory on November 3, 2025, credited to researcher avivdon. It was subsequently picked up by vulnerability tracking services including Vulners, CVEFeed, VulDB, and CIRCL, as well as noted in cybersecurity news aggregators. Red Hat also published a CVE entry for the issue. No major vendor statements beyond the Cursor team's advisory or notable independent researcher commentary have been identified at this time (GitHub Advisory, Red Hat CVE).