CVE-2025-54135: Cursor writes in-workspace files without user approval

Summary

Cursor, an AI-assisted code editor, allows writing files inside the workspace without user approval in versions below 1.3.9. Approval is required to edit an existing dotfile but not to create a new one, so when a sensitive file such as .cursor/mcp.json does not yet exist, an attacker can chain an indirect prompt injection to hijack the context, write the settings file, and trigger RCE on the victim without approval.

Mitigation

Fixed in version 1.3.9.

Coverage

News, research and other items that mention CVE-2025-54135.

• Cursor security: top 10 attacks and what each one actually brokeAdversa AI Blog · 2026-11-03

Topics

• Prompt injection and jailbreaks

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)