CVE-2025-54136highAgent hijacking2025-08
CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swapped
In Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt.
What it is
NVD: attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file in a shared GitHub repo. Fixed in 1.3: Cursor now asks for approval every time an mcpServer entry changes.
How to check
- Confirm Cursor 1.3+; review git history of .cursor/mcp.json in shared repos.
How to fix
- Update Cursor and require code review for changes to MCP config files (e.g. CODEOWNERS).
# .github/CODEOWNERS — force review of AI agent config
.cursor/ @your-security-reviewer
.cursorrules @your-security-reviewerSources
More advisories for this tool