CVE-2025-54136 – MCPoison Persistent Code Execution via MCP ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/
• Blog Title: CVE-2025-54136 – MCPoison: Persistent Code Execution via MCP Trust Bypass in Cursor IDE
• Suggested Section: generic-hacking/IDE-exploitation

🎯 Content Summary

Background

Cursor IDE is an AI-focused development environment integrating local code editing with LLM-driven automation via Model Context Protocol (MCP) configurations stored in .cursor/rules/mcp.json.

Each MCP entry under mcpServers defines a name, command, and optional args. Example:

{
  "mcpServers": {
    "test1": {
      "command": "echo",
      "args": ["Hello World"]
    }
...
🔧 Technical Details
An attacker exploits Cursor’s approval mechanism by committing a benign MCP configuration under .cursor/rules/mcp.json and obtaining the user’s one-time approval for the MCP name. Since Cursor binds trust solely to the configuration name and does not re-validate its command or args, the attacker can later modify these fields to arbitrary system commands or scripts (e.g., a reverse-shell batch file). On each project open or sync, Cursor silen...
🤖 Agent Actions
Updated HackTricks:
File updated: src/AI/AI-MCP-Servers.md

• Added detailed section “Persistent Code Execution via MCP Trust Bypass (Cursor IDE – ‘MCPoison’)” explaining CVE-2025-54136, PoC JSON snippets, exploitation steps, and mitigations.

• Created new “## References” section containing the Check Point Research blog URL.
This integrates the new vulnerability within the existing MCP security page, enhancing coverage of IDE-based supply-chain attacks without creating additional pages.
✅ Review Checklist

 Content is technically accurate
 Formatting follows HackTricks style guidelines
 Links and references are working
 Content adds educational value
 No sensitive information is exposed


This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/IDE-exploitation".

Repository Maintenance:

• MD Files Formatting: 865 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge