Security brief
Cursor MCPoison flaw let changed tool configurations retain earlier approval
REVIEWCheck Point’s 2025 disclosure shows why tool approval must cover configuration changes, not just a trusted name.
What happened
Check Point Research disclosed CVE-2025-54136 in August 2025. Cursor remembered approval for an MCP entry even after its underlying command or arguments changed, allowing a repository contributor to replace previously approved behavior.
The researchers demonstrated code execution in this workflow. The attack required an initial approval and subsequent control over the configuration; it was not evidence that every Cursor installation had been compromised.
Check Point says Cursor 1.3, released July 29, 2025, addressed the issue by requiring renewed approval after configuration changes. Teams should use a maintained release and review repository changes affecting local tools.
Who should check?
Teams running Cursor with repository-provided MCP tools.
Next step
Update Cursor and review changes to tool commands and arguments before approving them.
What we know
- Reported fix
- Cursor 1.3, according to Check Point’s testing.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
RESresearch.checkpoint.com Cursor MCPoison flaw let changed tool configurations retain earlier approval
Technical details
- CVE
CVE-2025-54136