Cursor — Security Profile

Product Overview

Cursor is an AI-powered IDE forked from VS Code, developed by Anysphere. It deeply integrates LLMs (GPT-4, Claude) for code generation, editing, and agentic task execution. Its attack surface is uniquely broad because it combines traditional IDE risks, AI agent risks, MCP integration risks, and inherited Chromium/Electron vulnerabilities.

Cursor Agent & IDE Vulnerabilities

CVE Table — Cursor-Specific Flaws

Attack Chains

MCP Poisoning (CurXecute):

Attacker configures external MCP server (e.g., Slack)
→ MCP server returns prompt injection payload in response data
→ Cursor Agent processes injected instructions
→ Agent rewrites ~/.cursor/mcp.json to include malicious MCP entry
→ With Auto-Run enabled, malicious commands execute immediately
→ Attacker achieves persistent RCE on developer's machine

Supply Chain via MCPoison:

Attacker commits benign .cursor/mcp.json to shared GitHub repo
→ Developer clones repo, opens in Cursor, approves MCP config
→ Attacker updates .cursor/mcp.json with malicious payload via new commit
→ Developer pulls latest code
→ Cursor trusts the previously-approved config — no re-approval needed
→ Malicious MCP commands execute automatically on every Cursor launch
→ Persistent RCE across all future sessions

Workspace Manipulation Chain:

Developer connects to compromised/malicious MCP server
→ MCP server returns prompt injection via tool output
→ Cursor Agent writes to .code-workspace file
→ Workspace settings modified to execute attacker's code
→ Code runs with developer's full privileges

Inherited Chromium Vulnerabilities

Cursor is built on an outdated VS Code fork that bundles an old Electron release, which embeds an outdated Chromium and V8 engine. As of late 2025, OX Security documented 94+ known CVEs in Cursor's Chromium build that have been patched upstream but not in Cursor.

Notable Inherited CVEs

Why This Matters

These aren't theoretical — CISA has added several of these to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The exploitation path demonstrated by OX Security:

Attacker crafts deeplink URL → triggers Cursor to open
→ Deeplink injects prompt telling Cursor's browser to visit attacker URL
→ Attacker's page serves JavaScript exploiting CVE-2025-7656
→ V8 integer overflow triggers → renderer crash / potential RCE

Control

The only effective control is for Anysphere to update Chromium. As an end user, you cannot patch this yourself. Mitigations:

• Run Cursor in an isolated VM or container for untrusted work
• Don't click deeplinks from untrusted sources
• Monitor for Cursor updates and apply immediately
• Consider using standard VS Code (which receives regular Chromium updates) for sensitive projects

Workspace Trust Vulnerability

Cursor ships with VS Code's Workspace Trust feature disabled by default. This means .vscode/tasks.json files with runOptions.runOn: "folderOpen" auto-execute the moment a developer opens a project folder — no prompt, no consent.

VS Code Extension Vulnerabilities (Shared with Cursor)

Because Cursor is a VS Code fork, it inherits vulnerabilities in VS Code extensions:

Hardening Recommendations

Immediate Actions

□ Update Cursor to the latest version
□ Enable Workspace Trust: Settings → search "trust" → enable
□ Set task.allowAutomaticTasks: "off"
□ Audit .cursor/mcp.json in all projects
□ Audit .vscode/tasks.json in all projects
□ Disable Auto-Run for MCP servers
□ Remove unused extensions

Organizational Controls

□ Mandate Cursor updates via endpoint management
□ Deploy file integrity monitoring on .cursor/ and .vscode/ directories
□ Block deeplink execution from untrusted sources
□ Run Cursor in containers/VMs for untrusted repositories
□ Monitor for unexpected child processes spawned by Cursor
□ Maintain an approved MCP server allowlist
□ Consider using standard VS Code for high-security projects
□ Log and alert on MCP configuration changes

What to Test in Engagements

Cursor Red Team Checklist

□ MCP config injection — can you write to .cursor/mcp.json via prompt injection?
□ MCP trust persistence — does a modified config retain approval?
□ Workspace Trust bypass — does .vscode/tasks.json auto-execute on folder open?
□ Agent file write scope — can the Agent write to config files?
□ Deeplink exploitation — can deeplinks trigger browser navigation?
□ Case-sensitivity bypass — test file protection with mixed-case paths
□ Extension vulnerability testing — Live Server, Code Runner, Markdown Preview
□ Workspace file manipulation — can prompt injection modify .code-workspace?
□ OAuth MCP impersonation — can a rogue server gain trusted MCP status?
□ Chromium version check — what Chromium version is bundled?
□ Prompt injection via MCP tool output — can external tools inject instructions?