Cursor versions 1.7 and below are susceptible to remote code execution through a command injection vulnerability when interacting with untrusted MCP servers.

The vulnerability is an OS Command Injection (CWE-78) occurring when the application uses OAuth authentication with an untrusted MCP server. An unauthenticated attacker can impersonate a server to inject and execute arbitrary commands with full user privileges on the host system.

Successful exploitation allows an attacker to execute arbitrary code on the host machine, leading to a full system compromise. Given the CVSS score of 8.8, this vulnerability poses a severe risk to development environments, potentially exposing proprietary source code, secrets, and credentials stored within the developer workstation.

Immediate Action: Apply the available patch, 2025.09.17-25b418f, provided by the vendor to remediate the command injection flaw.

Proactive Monitoring: Monitor system logs for unexpected child processes spawned by the Cursor editor or unusual network connections initiated to unknown MCP servers.

Compensating Controls: Avoid connecting the editor to untrusted or unverified MCP servers until the patch is applied, and ensure the development environment is isolated from sensitive production networks.

Public Exploit Available: Unknown

This is a critical vulnerability that requires immediate attention due to the potential for full system compromise. Users and IT administrators should prioritize applying the vendor provided patch, 2025.09.17-25b418f, as soon as possible to mitigate the risk of arbitrary command execution.