CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135) - ATR-2026-02022 (87ed73ef-96e4-5aa3-8930-2bb5d80bc4ab)
Detects the CurXecute attack (CVE-2025-54135, CVSS 8.6) reported by Cato Networks against Cursor IDE < 1.3.9. Cursor auto-starts any MCP server the moment an entry is written to .cursor/mcp.json (workspace) or ~/.cursor/mcp.json (global) — before the user approves the edit. An attacker chains an indirect prompt injection (e.g. a crafted Slack message read via a Slack MCP server, or poisoned repo/issue content) that instructs the agent to "improve" mcp.json by adding a server whose command/args run attacker code (curl|bash, a reverse shell, or a dropped file). Because the write itself triggers execution, the payload runs even if the user later rejects the suggestion. This rule fires on the concrete signature — a directive to write a Cursor mcp.json server entry carrying an executable command — not on prose naming the CVE. Fixed in 1.3.9, which requires explicit approval for any mcp.json change.