CVE-2025-64106

Executive Summary

CVE-2025-64106 is a high-severity input validation vulnerability in Cursor, an AI-powered code editor. Versions 1.7.28 and below fail to properly validate specially crafted deep-links used for MCP (Model Context Protocol) server installation. An attacker can craft a malicious deep-link that bypasses standard security warnings and conceals the actual commands to be executed. If a victim is convinced to navigate to such a link and accepts the server installation, arbitrary commands specified by the attacker are executed on the victim's machine. The CVSS score is 8.8 (High), and no patch has been confirmed at the time of analysis.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over a network via a deep-link.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a malicious link.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click the link and accept the server installation.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to local files and secrets.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Potential for system compromise or denial of service.

Threat Level: High. The vulnerability allows remote code execution with user interaction, but the low complexity and high impact make it a prime target for phishing campaigns.

Deep Dive & Mechanics

Cursor's MCP server installation feature uses deep-link URIs (e.g., cursor://mcp/install?server=...) to trigger the installation of external MCP servers. The vulnerability lies in the input validation of the server parameter. The application does not properly sanitize or escape the parameter, allowing an attacker to inject arbitrary command-line arguments or shell commands.

When a victim clicks a malicious deep-link, Cursor parses the URI and constructs a command to install the MCP server. Due to the input validation flaw, the attacker can embed commands that are executed without being displayed in the security warning modal. The modal may show a benign server name, while the actual executed command is hidden or truncated.

Attack Flow:

1. Attacker crafts a deep-link: cursor://mcp/install?server=legit-server&cmd=calc.exe
2. Victim clicks the link (e.g., via email, social media, or a malicious website).
3. Cursor opens and displays a security warning modal with a manipulated or incomplete command string.
4. Victim accepts the installation.
5. The injected command (calc.exe or any arbitrary payload) executes on the victim's machine.

The vulnerability is classified under CWE-20 (Improper Input Validation) because the application fails to validate and sanitize the deep-link parameters before constructing the execution command.

Vulnerable vs. Patched Code

Vulnerable Code (Cursor <= 1.7.28):

// Pseudocode for vulnerable deep-link handler
function handleMCPInstall(uri) {
    const params = new URLSearchParams(uri.query);
    const serverName = params.get('server');
    const command = `cursor-mcp install ${serverName}`;
    // No validation or sanitization of serverName
    showModal(command); // Modal may truncate or misrepresent command
    if (userAccepts) {
        exec(command); // Executes attacker-controlled command
    }
}

Patched Code (Hypothetical fix):

// Pseudocode for patched deep-link handler
function handleMCPInstall(uri) {
    const params = new URLSearchParams(uri.query);
    const serverName = params.get('server');
    // Validate serverName against a whitelist of allowed characters
    if (!/^[a-zA-Z0-9_-]+$/.test(serverName)) {
        showError('Invalid server name');
        return;
    }
    const command = `cursor-mcp install ${serverName}`;
    showModal(command); // Modal shows exact command
    if (userAccepts) {
        exec(command);
    }
}

The patched version would implement strict input validation, ensuring that the server parameter contains only alphanumeric characters, hyphens, and underscores. Additionally, the modal should display the exact command to be executed without truncation.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Windows 10/11 or macOS with Cursor 1.7.28 installed.
• A web server or email client to deliver the malicious deep-link.

Exploit Payload:

<a href="cursor://mcp/install?server=legit&cmd=powershell -e JABlAHgAZQBjAHUAdABpAG8AbgBfAHAAYQB5AGwAbwBhAGQA">Click here for AI features</a>

Steps:

1. Host the above HTML on a phishing page or send it via email.
2. Victim clicks the link.
3. Cursor opens and shows a modal with a truncated or manipulated command (e.g., only "cursor-mcp install legit").
4. Victim accepts.
5. The injected PowerShell payload executes, establishing a reverse shell or downloading malware.

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Cursor process executions with command-line arguments containing mcp/install and suspicious parameters.
• Alert on deep-link URIs containing cursor:// that include cmd, exec, or other shell-related parameters.
• Use endpoint detection and response (EDR) to monitor for child processes spawned by Cursor (e.g., cmd.exe, powershell.exe, bash).

Defense:

• Block or warn on deep-link URIs from untrusted sources.
• Implement application whitelisting to prevent Cursor from executing arbitrary commands.
• Educate users not to click on unsolicited deep-links.

Indicators of Compromise (IOCs)

• Network IOCs:

  • URIs containing cursor://mcp/install?server= with suspicious parameters.
  • Outbound connections to attacker-controlled IPs after exploitation.

• Host IOCs:

  • Cursor process (Cursor.exe or Cursor) spawning cmd.exe, powershell.exe, or bash.
  • Registry or file modifications in Cursor's installation directory.
  • Unexpected files in %TEMP% or /tmp created by Cursor.

• File IOCs:

  • Malicious deep-link files (.url, .html, .lnk) containing cursor:// URIs.

Detection Engineering

YARA Rule

rule CVE_2025_64106_Cursor_MCP_DeepLink {
    meta:
        description = "Detects malicious deep-link URIs targeting Cursor MCP server installation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64106"
    strings:
        $cursor_uri = "cursor://mcp/install?server="
        $suspicious_param = /[&?](cmd|exec|command|payload)=/
    condition:
        $cursor_uri and $suspicious_param
}

Sigma Rule

title: Cursor MCP Deep-Link Exploitation Attempt
id: cve-2025-64106
status: experimental
description: Detects attempts to exploit CVE-2025-64106 via malicious deep-links
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Cursor.exe'
        CommandLine|contains: 'cursor://mcp/install?server='
    condition: selection
falsepositives:
    - Legitimate MCP server installations from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64106 Cursor MCP Deep-Link Exploitation"; flow:to_server,established; content:"cursor://mcp/install?server="; nocase; pcre:"/[&?](cmd|exec|command|payload)=/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable MCP deep-link handling if not required, by modifying Cursor's configuration or using group policy.
2. Update Cursor to the latest version as soon as a patch is released.
3. Block cursor:// URIs at the email gateway or web proxy level.

Long-term Fixes:

• Implement strict input validation for all deep-link parameters.
• Display the full, unmodified command in the security warning modal.
• Require explicit user confirmation for any command execution.

Workarounds:

• Use a different code editor until a patch is available.
• Educate users to avoid clicking on deep-links from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert