CVE-2025-54135

Named by 5 kept items in this workspace.

Search every workspace for CVE-2025-54135. It matches the name as written, so it can find other things that share it.

The items that name it 5

Vulnerability Garden
tool2026-05-13
Pantheon-Security/medusa
repo2026-05-10It is written here as CVE-2025-54135 (CurXecute, Cursor MCP RCE).
CurXecute, Cursor MCP RCE
anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection
repo2026-05-07
Cursor indirect prompt injection via MCP config leading to RCE
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
article
CurXecute: a planted Slack message rewrote Cursor's ~/.cursor/mcp.json config and ran commands even after the user rejected the edit.
973 MCP Packages, 71% Single-Maintainer: A Practitioner
articleIt is written here as CVE-2025-54135 (Cursor IDE, CVSS 9.8, CurXecute: indirect prompt injection in repo files creates malicious .cursor/mcp.json, achieves RCE).
Cursor IDE, CVSS 9.8, CurXecute: indirect prompt injection in repo files creates malicious .cursor/mcp.json, achieves RCE

All cves in this workspace.