CVE-2025-54133

Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog

State: Published
Severity: 5.3 Medium
Published: Aug 1, 2025
Updated: Aug 4, 2025
Reserved: Jul 16, 2025

Description

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When users click malicious `cursor://anysphere.cursor-deeplink/mcp/install` links, the installation dialog does not show the arguments being passed to the command being run. If a user clicks a malicious deeplink, then examines the installation dialog and clicks through, the full command including the arguments will be executed on the machine. This is fixed in version 1.3.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
cursorcursor	>= 1.17, < 1.3Affected

References

https://github.com/cursor/cursor/security/advisories/GHSA-r22h-5wp2-2wfv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.