A critical OS command injection vulnerability in the Cursor code editor enables attackers to achieve remote and persistent code execution by manipulating MCP configuration files.

The software suffers from improper neutralization of special elements used in an OS command (CWE-78). Attackers with write permissions to an MCP configuration file or the ability to perform arbitrary local file writes can inject malicious commands that execute silently when a user interacts with a compromised repository or configuration.

The ability for an attacker to achieve remote code execution on a developer workstation poses a severe threat to the integrity of the entire software development lifecycle. Compromised workstations can lead to the theft of intellectual property, the introduction of malicious code into production pipelines, and unauthorized access to internal development environments. With a CVSS score of 7.2, this vulnerability represents a significant risk to organizational security posture.

Immediate Action: Update the Cursor code editor to version 1.3 or later immediately to incorporate the necessary security fixes.

Proactive Monitoring: Review access logs and GitHub repository activity for unauthorized modifications to .cursor or MCP-related configuration files.

Compensating Controls: Restrict repository write permissions to trusted collaborators only and avoid importing or approving MCP configurations from untrusted or unknown sources.

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Given the potential for full remote code execution and the availability of public proof-of-concept material, this vulnerability should be prioritized for immediate remediation. Organizations must ensure that all instances of Cursor are updated to version 1.3 or higher to prevent unauthorized command execution and protect development assets from compromise.