CVE-2025-54135: Cursor agent could create .cursor/mcp.json without approval (fixed 1.3.9)

What happened

• According to Cursor's advisory (Aug 2, 2025), Cursor allowed writing in-workspace files without approval; editing an existing dotfile needed approval but creating a new one did not. [1][2]

Impact

• Chained with an indirect prompt injection, an attacker could make the agent write .cursor/mcp.json and trigger remote code execution without user approval (CVSS 8.5). [1][2]

What was done

• Fixed in 1.3.9: the agent is blocked from writing MCP-sensitive files without approval. [1][2]

How to protect yourself

• Update Cursor to 1.3.9 or later. [2]

Sources

1. GHSA-4cxx-hrm3-49rm — Cursor (GitHub security advisory)
2. CVE-2025-54135 — NVD

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.