CVE-2025-54133 is a critical (CVSS 9.6) flaw in the Cursor code editor. The MCP install deeplink dialog did not show the arguments of the command it would run, so a crafted link could lead to arbitrary command execution after two clicks. Versions 1.17 through 1.2 are affected; version 1.3 fixes it.
What's affected
- The record lists versions 1.17 through 1.2 as affected. The record text gives the range in that form, so check the advisory for the exact boundaries.
- Cursor 1.3 is the fixed version named in the advisory.
The record lists CVSS 9.6 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the Cursor version in the About dialog or with the command line launcher.
cursor --version
Then open your MCP settings and review every configured server. Remove any you did not add on purpose.
What to do now
- Update Cursor to 1.3 or later.
- Audit your configured MCP servers and remove unknown entries.
- Do not click MCP install links from chat, email or web pages you do not trust.
- Tell your team: an install dialog is only as useful as what it shows. Read the full command before approving anything.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
Two weakness classes apply. The dialog disclosed too little (CWE-200 as the record tags it), and the thing it was hiding ended in command execution (CWE-78). The user did consent, but consent was given on incomplete information.
MCP servers are launched as local commands, so an install flow is effectively a way to run a program on a developer laptop. Treat a deeplink the way you would treat a downloaded installer.
Severity scores are a starting point. The score for this entry is 9.6, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
What makes this critical rather than high?
The record scores it 9.6, with command execution on the victim machine and a changed scope. It still needs a user to click, which is why it is described as social engineering.
Does updating remove an MCP server I already installed?
The advisory does not say it does. Review your server list yourself after updating.
Sources
Last reviewed: 18 October 2026.
