CVE-2025-54136: Cursor did not re-ask approval when a trusted MCP entry changed

What happened

• According to Cursor's advisory (Aug 1, 2025), once a collaborator approved a harmless MCP server, an attacker could modify the already trusted MCP configuration (for example in a shared GitHub repository) and swap in a malicious command without any warning or re-prompt. [1][2]

Impact

• Remote and persistent code execution for anyone with write access to the user's active branches or local file-write (CVSS 7.2). [1]

What was done

• Cursor now requires user approval every time an mcpServer entry is modified. Patched version: 1.3. [1]

How to protect yourself

• Update Cursor to 1.3 or later. [1]

Sources

1. GHSA-24mc-g4xr-4395 — Cursor (GitHub security advisory)
2. CVE-2025-54136 — NVD

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.