Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval
· Source: thehackernews.com
In short
Cybersecurity researchers have disclosed a high-severity security flaw in the AI-powered code editor Cursor, allowing remote code execution via malicious MCP file swaps after initial approval. The vulnerability, CVE-2025-54136, exploits trust in Model Context Protocol (MCP) configurations, enabling attackers to silently replace benign files with malicious payloads. The issue has been patched in Cursor version 1.3, requiring user approval for all MCP configuration changes.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 32, 2025: AI-Driven Supply Chains Forge Resilience Amid Geopolitical and Security Risks
Tags: cybersecurity, vulnerability, AI, RCE, MCP, supply-chain