CVE-2025-54135 is a high severity (CVSS 8.5) flaw in the Cursor code editor. In versions below 1.3.9, a missing .cursor/mcp.json file could be created without user approval, so a prompt injection could plant an MCP server definition and run commands. Cursor 1.3.9 contains the fix.
What's affected
- Cursor versions below 1.3.9 are affected, per the record.
- Cursor 1.3.9 is the fixed version named in the advisory.
The record lists CVSS 8.5 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check your Cursor version.
cursor --version
Then look for .cursor/mcp.json in your workspaces and in your home directory configuration. If a file exists that you did not write, read it before you open the project again.
What to do now
- Update Cursor to 1.3.9 or later.
- Inspect every
.cursor/mcp.jsonin your repositories for servers you did not add. - Be careful opening unfamiliar repositories with an agent enabled.
- Keep MCP server configuration out of shared project folders unless a reviewer signs off on changes.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
This is a sibling of CVE-2025-54130. The approval gate covered editing an existing dotfile but not creating a new one. The record tags the weakness as CWE-78 and CWE-829, command injection and inclusion of functionality from an untrusted control sphere.
An MCP config file is a list of commands to launch. Whoever can write it can choose what runs. When an AI agent can write that file after reading hostile text, the trust boundary has moved without anyone deciding to move it.
Severity scores are a starting point. The score for this entry is 8.5, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
How is this different from CVE-2025-54130?
Both come from the same approval gap. This one targets the MCP configuration file; the other targets editor settings.
Is a fix available?
Yes. The advisory names Cursor 1.3.9.
Sources
Last reviewed: 18 October 2026.
