HighVulnerability

CVE-2025-61591: Cursor command injection via MCP OAuth with untrusted server

Source: NVD(opens in a new tab)
Identifier: CVE-2025-61591
Published: October 3, 2025
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 1.2%

Summary

CVE-2025-61591 affects Cursor, a code editor built for programming with AI, in versions 1.7 and below. When MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate that server and return crafted commands during interaction, enabling command injection. Chained with an untrusted MCP service via OAuth, the flaw could let the agent execute arbitrary code on the host with full user privileges.

Mitigation

This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.

Details

Scores and exploitation

CVSS score: 8.8(high)
EPSS: 1.2%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 3, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-78
Attack pattern (CAPEC): CAPEC-88
AI threat technique (MITRE ATLAS): AML.T0010

Classification

Attack type: Supply chain,
Other
Attack sophistication: Moderate
AI component targeted: Agent
Impact: Confidentiality,
Integrity,
Availability,
Safety
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-61591

First tracked: February 15, 2026 at 08:53 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Topics

Model Context Protocol

Summary

Mitigation

Topics

Related items