A critical remote code execution vulnerability in the Cursor CLI allows attackers to execute arbitrary commands on a victim's machine by leveraging the Model Context Protocol (MCP) server mechanism.

This is an OS command injection flaw (CWE-78) where the application fails to safely handle configurations defined in the .cursor/mcp.json file. An unauthenticated attacker can craft a malicious configuration file that executes arbitrary system commands immediately upon the user opening the repository in the Cursor editor.

Successful exploitation of this vulnerability leads to full remote code execution on the developer's workstation. Given the CVSS score of 8.8, this represents a high-severity risk that could result in the compromise of sensitive credentials, source code theft, or the deployment of persistent backdoors within the development environment.

Immediate Action: Update the Cursor application to version 2025.09.17-25b418f or later immediately to incorporate the patch for the MCP configuration parser.

Proactive Monitoring: Security teams should audit developer environments for suspicious file modifications within the .cursor directory of cloned repositories.

Compensating Controls: Advise developers to exercise extreme caution when cloning or opening untrusted repositories from unknown sources until the software update is applied.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to development organizations by turning a common workflow, such as cloning a repository, into an attack vector. Organizations must prioritize the update of all Cursor installations to the patched version across all developer workstations to prevent potential system compromise and lateral movement within the corporate network.